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I.  Abstract 

This  research  addresses  the  study  of  Network  Adaptability  from  Weapons  of  Mass 
Destruction  (WMD)  Disruption  and  Cascading  Failures.  The  general  theme  of  the 
research  studies  the  problems  of  combating  disruptions  due  to  WMD  (C-WMD)  on 
networks,  taking  into  account  real-world  dynamics  on  critical  infrastructures  that 
are  vulnerable  to  such  attacks.  Our  research  examines  new  modes  of  attack  that  are 
relevant  to  WMD  analysis,  and  considers  networks  that  are  overlays  of  several 
individually  functioning  (but  related)  structures  such  as  telecommunications, 
transportation,  and  electricity  grids.  More  importantly,  we  analyze  network 
dynamics  that  include  cascading  failures  due  to  capacities  on  nodes  and  links, 
decentralized  behavior  due  to  independent  agents  on  these  networks,  and  adaptive 
recovery  schemes  in  telecommunications  settings.  Thus,  our  analysis  goes  far 
beyond  simple  connectivity  measures  of  graphs  as  a  metric  of  damage,  and 
considers  much  more  relevant  forms  of  disruption  that  could  occur  on  our  nation’s 
infrastructure. 

To  combat  these  attacks,  we  examine  the  prevention  and  mitigation  of  attacks  via 
intelligent  mobile  agent  deployment,  and  via  robust  system  design  and  recovery 
techniques  that  respond  to  worst-case  WMD  attacks.  As  a  result,  we  demonstrate 
how  to  most  effectively  deploy  existing  and  emerging  technologies  in  concert  with 
one  another.  Finally,  we  demonstrate  how  to  design  robustly  connected  networks 
that  efficiently  respond  to  massive  localized  outages.  The  proposing  team  utilizes 
techniques  that  hybridize  mixed-integer  programming,  approximation  theory,  and 
game  theory  in  order  to  guarantee  desired  levels  of  network  operability. 

II.  Objective 

The  research  seeks  to  develop  theory  and  algorithms  for  problems  that  arise  in 
combating  disruptions  due  to  Weapons  of  Mass  Destruction  (WMD)  on  networks. 
The  science  of  countering  WMD  has  shifted  in  the  last  decade,  and  now  tends  to 
focus  on  a  system-wide  integration  of  fortification  resources,  strategically  deployed 
to  combat  an  intelligent  adversary.  Despite  the  growing  threat  of  WMD  attacks, 
coinciding  with  a  recent  proliferation  of  network  interdiction  studies,  optimal 
interdiction  and  defense  studies  against  WMDs  is  still  an  area  of  vital  research 
importance  due  to  the  number  of  open  questions  that  exist  in  this  realm.  Our 
proposal  identified  several  key  goals  to  bridge  the  gap  between  current  research 
network  interdiction  studies,  and  the  theory  and  algorithms  needed  to  tackle  the 
countering  of  WMD  attacks. 


Develop  new  interdiction  models  and  algorithms  in  which  an  interdictor 
destroys  a  set  of  arcs  that  are  geographically  close  to  one  another.  In  contrast 
to  previous  research,  which  assumes  that  individual  disparate  pieces  of  the 
network  can  be  simultaneously  attacked,  our  approach  is  directly  applicable 
to  WMD  analysis  and  provides  a  far  more  realistic  assessment  of  network 
vulnerabilities. 

Study  dynamic  networks,  noting  that  the  state  of  current  and  emerging 
networks  increasingly  adopts  this  paradigm.  We  also  embed  considerations 
of  uncertain  attack  and  defense  effectiveness  in  our  models  for  this  goal  to 
further  improve  the  realistic  nature  of  our  models. 

Examine  decentralized  recovery  techniques  that  many  critical  networks 
adopt  under  disruptions. 

Synthesize  the  results  of  the  prior  goals  and  consider  fortification  problems 
on  networks  under  adaptive  and  distributive  recovery  schemes. 

Focus  on  optimally  detecting  and  containing  cascading  failures,  especially  in 
the  case  of  attacks  designed  to  propagate  across  networks  (including,  e.g., 
biological  agents). 

Apply  our  algorithms  on  test  beds  that  simulate  real-world 
telecommunication,  transportation,  and  power  grids. 

Develop  compact  formulations  for  "generalized  network  interdiction 
problems,"  in  which  clusters  having  a  special  structure  can  be  deleted  from  a 
network,  rather  than  just  individual  nodes  or  links. 

Identify  new  methods  for  critical  network  (node)  element  detection  in 
interdependent  systems,  especially  those  having  cascading  failures. 

Explore  dynamic  interdiction  problems,  in  which  two-stage  games  are 
replaced  by  ongoing  games  in  which  an  adversary  destroys  links,  and  the 
network  operator  can  rebuild  links  over  time. 

Examine  the  problem  in  which  edges  and  clusters  can  be  removed  and  are 
deemed  as  critical  elements. 

Determine  how  to  couple  interdependent  networks  in  order  to  create  a 
robust  system  of  networks.  Given  the  presence  of  various  networks,  this  goal 
seeks  to  determine  which  edges  should  be  constructed  to  mitigate  the 
deleterious  effects  of  cascading  failures. 


III.  Approach 


The  approach  taken  in  this  proposal  uses  a  combination  of  interdiction  algorithms, 
global  optimization,  combinatorial  analysis,  approximation  algorithms,  and 
decentralized  computing.  While  the  technical  details  are  best  left  to  the  papers 
themselves,  the  general  approach  that  we  employ  to  address  these  problems  is 
explained  below. 

The  interdiction  problems  we  consider  involve  two  players:  An  attacker  and  a 
defender.  The  attacker  moves  first,  and  with  knowledge  of  the  attacker’s  move,  the 
defender  moves  next.  The  defender  is  usually  trying  to  optimize  some  objective 
over  the  network,  such  as  finding  a  shortest  origin-destination  path,  maximizing 
flow  between  two  terminals,  or  maximizing  network  reliability.  Therefore,  the 
attacker  seeks  to  inhibit  the  defender’s  objective,  e.g.,  by  maximizing  his  shortest 
path,  or  minimizing  his  maximum  flow.  The  defender  may  in  some  situations  act 
first  in  a  fortification  stage  (producing  so-called  defender-attacker-defender 
models).  Otherwise,  we  refer  to  the  problem  as  attacker-defender  models. 

If  the  defender  makes  decisions  in  a  centralized  manner  (by  controlling  all  aspects 
of  his  actions,  with  full  knowledge  of  the  system,  and  with  the  ability  to  jointly 
utilize  all  of  his  resources),  then  these  problems  can  be  stated  as  "min-max"  (or 
max-min)  optimization  problems:  The  attacker  acts  with  the  assumption  that  the 
defender  will  act  optimally  given  the  attacker’s  actions.  (Moreover,  in  some 
versions  of  our  problem,  the  defender  may  actually  pre-empt  certain  attacker 
options  with  an  initial  fortification  action.) 

On  the  other  hand,  the  defender  may  be  decentralized,  in  the  sense  that  network 
resources  (e.g.,  monitors  or  communication  hubs)  are  not  jointly  controlled  by  some 
unified  force,  but  instead  react  only  to  local  information  that  it  can  access.  In  this 
case,  the  defender  is  said  to  be  adaptive.  In  this  case,  the  defender  is  generally 
incapable  of  making  an  optimal  response,  but  would  instead  have  autonomous 
recovery  protocols  established  throughout  the  network  (e.g.,  as  would  be  required 
in  communication  restoration). 

One  aim  of  this  research  seeks  to  piece  together  network  complexity  theory  with 
nonlinear  optimization  theory  and  basic  Euclidean  geometry  analysis,  in  order  to 
tackle  the  class  of  network  interdiction  and  optimization  problems  over  continuous 
spaces.  Furthermore,  we  have  made  very  significant  findings  with  respect  to 
interdiction  and  competition  arising  in  discrete  games  over  networks.  This  includes 
the  path  planning  problems  mentioned  above  along  with  graph  disconnection  and 
clustering  challenges. 

Another  aim  is  to  develop  a  framework  for  designing  decentralized  algorithms  that 
recover  from  network  failures  (perhaps,  but  not  necessarily,  due  to  intentional 
disruptions).  Our  methods  are  called  adaptive  approximation  algorithms,  because 
they  do  not  assume  the  presence  of  a  centralized  optimizing  entity  (hence, 


adaptive),  but  yet  still  perform  with  some  guarantee  of  near-optimality  despite  their 
distributed  nature.  This  class  of  methods  is  particularly  vital  in  networks  that  are 
dynamic  and  evolving. 


IV.  Work  Accomplished: 

A  summary  of  some  of  our  primary  work  accomplishments  is  presented  in  Section 
IV.  1,  with  a  list  of  specific  accomplishments  given  in  Section  IV.2. 


IV.  1  Overview 

Geographical  interdiction.  One  major  research  thrust  regards  network  vulnerability 
assessments  with  geographical  interdiction.  In  fact,  our  proposed  geometric 
interdiction  problems  have  proven  to  be  extremely  difficult  to  solve,  and  evidently 
require  a  refine-and-partition  type  of  strategy  to  approximate.  The  tasks  at  hand 
are  to  provide  tight  lower-  and  upper-bounding  strategies  for  these  problems, 
solving  a  series  of  subproblems  that  are  relatively  tractable.  In  2013,  we  reported 
that  this  paper  was  accepted  for  publication  in  Networks,  and  it  appeared  in  2014. 
Recently,  this  paper  was  awarded  the  Glover-Klingman  prize  for  best  paper 
appearing  in  a  2014  issue  of  Networks. 

Also,  regarding  progress  on  geometric  optimization  problems,  a  study  on  extending 
the  lifetime  of  wireless  sensor  networks  spawned  papers  in  INFORMS  Journal  on 
Computing,  IEEE  Transactions  on  Mobile  Computing,  and  HE  Transactions.  The  latter 
journal  is  the  flagship  journal  of  the  Institute  of  Industrial  Engineers,  and  their 
professional  magazine  featured  our  work  (Romich  et  al.  2015a)  in  the  May  2015 
issue  of  their  Industrial  Engineer  magazine. 

Understanding  network  structures  can  reveal  behavioral  functions  as  well  as  the 
vulnerability  of  the  network.  Knowledge  of  this  structure  provides  us  not  only 
crucial  information  about  network  principles,  but  also  key  insights  into  designing 
more  effective  algorithms  for  practical  problems.  In  particular,  fathoming  the 
interplay  of  different  network  elements  as  part  of  network  evolution  enabled  by 
dynamics  of  the  network  leads  to  better  understanding  of  the  vulnerability  of 
network  elements.  Many  practical  problems  on  complex  networks,  such  as  routing 
strategies  in  MANETs,  sensor  reprogramming  in  WSNs  and  worm  containment  in 
online  social  networks  (OSNs)  share  an  ubiquitous,  yet  interesting  feature  in  their 
organizations:  community  structure.  However,  understanding  this  interesting 
feature  is  extremely  challenging  on  dynamic  networks  where  changes  to  their 
topologies  are  frequently  introduced,  and  especially  when  network  communities  in 
reality  usually  overlap  with  each  other. 


We  investigate  network  vulnerability  based  on  communities  obtained  from 
underlying  topology,  which  has  not  been  investigated  in  the  literature.  To  achieve 


these  goals,  we  introduce  several  new  models  based  on  the  observation  that  most 
complex  networks  exhibit  a  network  modular  property.  A  network  module  may 
represent  a  functional  group,  a  component,  or  an  entity  within  the  network  system 
and  the  correlation  among  modules  can  model  and  describe  the  interplay  between 
network  components. 

We  have  included  the  dynamics  and  evolution  of  a  network  in  the  analysis  of 
inherent  modules,  which  is  a  new  task  that  has  not  yet  been  well  investigated.  The 
study  of  such  evolution  requires  computing  modules  of  the  network  at  different 
time  instances.  However,  identifying  network  modules  in  each  state  of  the  network 
from  scratch  may  result  in  prohibitive  computational  costs,  particularly  in  the  case 
of  highly  dynamic  networks.  In  addition,  it  may  be  infeasible  in  the  case  of  limited 
topological  data.  In  this  regard,  the  study  requires  us  to  solve  many  interesting 
problems  such  as: 

(a)  How  to  devise  new  measures  and  methods  for  computing  network  modules 
that  are  robust  to  changes, 

(b)  How  to  easily  update  the  modules  once  the  changes  occur  without  re¬ 
calculating  them  from  scratch,  and 

(c)  How  sensitive  the  community  structure  is  with  respect  to  the  failures  of 
nodes  and  edges. 

These  studies  aid  in  understanding  the  evolution  of  network  components,  and 
provide  a  robust  solution  for  many  applications  which  are  sensitive  to  the  structure 
of  network  communities. 

Next,  with  respect  to  critical  element  selection  in  networks,  our  team  has  published 
in  IEEE  Transactions  on  Reliability  on  the  topic  of  the  robustness  of  power-law 
networks.  Dr.  Thai  has  also  been  active  on  this  research  topic,  with  work  appearing 
in  the  INFOCOM  and  GLOBECOM  conference  proceedings. 

We  have  also  focused  on  the  problem  of  removing  cliques  that  maximally  disconnect 
a  network.  This  problem  is  called  the  Critical  Clique  Problem  (CCP).  We  give  special 
attention  to  variations  of  the  CCP  where  different  objectives  functions  are  used,  such 
as  the  number  of  pairwise  connections,  the  size  of  the  largest  component,  and  the 
total  number  of  residual  components,  among  others.  In  addition,  we  are  also 
interested  in  solving  this  problem  when  several  conditions  over  the  cliques  are 
required,  including  upper  and  lower  bounds  on  the  size  of  the  cliques.  Finally,  we 
are  also  adapting  the  proposed  techniques  for  detecting  other  critical  structures  as 
well.  See  Walteros  and  Pardalos  (2012)  for  more,  and  also  Shen  and  Smith  (2012a, 
2012b)  for  related  node-deletion  studies.  We  also  published  several  theoretical  and 
algorithm  results  regarding  these  problems  over  the  funding  period,  particularly  in 
a  pair  of  book  chapters  and  in  the  journal  Theoretical  Computer  Science. 

We  also  examine  Stackelberg  problems  (attacker-defender,  or  defender-attacker- 
defender)  in  which  both  players  are  faced  with  NP-hard  problems.  These  problems 


are  notoriously  difficult  to  solve  and  have  resisted  practical  solution  efforts  thus  far. 
Our  goal  is  also  to  expand  the  scope  of  problems  that  can  benefit  from  our  research, 
especially  in  communication  and  sensor  network  settings.  Another  application  area 
arises  in  civilian  business  scenarios  that  serve  as  proxies  for  military  settings  (e.g., 
models  that  can  equivalently  describe  marketing  challenges  or  military  defense 
strategies). 

Toward  this  goal,  we  have  proposed  a  substantially  new  approach  for  problems  that 
take  place  in  defender-attacker-defender  settings.  The  salient  concepts  can  be 
presented  in  the  attacker-defender  max-min  problem.  One  frequently  solves  this 
type  of  problem  by  assuming  that  the  follower's  problem  is  convex,  taking  the 
(strong)  mathematical  programming  dual  of  the  follower’s  problem,  and  combining 
the  follower’s  problem  (now  converted  to  a  maximization  problem)  with  the 
leader’s  problem.  If  the  resulting  combined  problem  is  nonlinear,  which  is  typically 
the  case,  then  some  linearization  strategy  can  be  applied  to  convert  the  problem  to  a 
mixed-integer  linear  programming  problem  (MILP).  This  approach  suffers  from  two 
drawbacks.  One,  the  resulting  MILP  is  typically  very  difficult  to  solve.  Two,  the 
italicized  assumption  above  is  limiting,  and  precludes  the  analysis  of  interdiction 
problems  in  which  the  follower  solves,  e.g.,  a  discrete  optimization  problem.  (One 
such  study  was  accepted  for  publication  in  2015.  This  paper,  Tang  et  al.  (2015), 
regards  theoretical  foundations  for  solving  two-stage  integer  interdiction  problems, 
and  provides  provably  optimal  algorithms  for  their  solution.  Those  algorithms, 
however,  are  not  scalable  to  large-scale  instances.) 

We  have  invented  an  entirely  different  concept  behind  solving  these  problems, 
which  involves  sampling  potential  defender  solutions,  and  playing  the  game  only 
over  this  sample.  The  sample  space  is  then  adaptively  expanded  until  optimality  can 
be  proven.  The  algorithm  we  propose  is  not  only  capable  of  solving  problems  in 
which  the  follower’s  problem  is  an  integer  program,  but  our  computational 
experiments  show  that  it  far  more  effective  in  solving  traditional  interdiction 
problems.  For  instance,  consider  the  solution  of  shortest-path  interdiction 
problems  with  fortification  (SPIF):  The  defender  first  fortifies  arcs  against  attack, 
the  attacker  then  damages  several  undefended  arcs  (thus  extending  their 
interdiction  costs),  and  the  defender  then  selects  a  shortest  path  on  the  remaining 
network.  We  compared  our  algorithm  to  the  current  state-of-the-art  algorithm  for 
these  problems.  On  a  set  of  sixty  900-node  instances,  we  obtained  optimal  solutions 
in  1.7  seconds  on  average,  as  opposed  to  766.9  seconds  on  average  using  the  current 
state-of-the-art,  a  speedup  of  450  times.  (The  maximum  computation  times  were 
7.5  seconds  for  our  approach,  and  12,728.8  seconds  for  the  incumbent  approach.) 
These  results  are  particularly  exciting,  because  the  SPIF  is  a  very  well-studied 
problem.  The  details  are  included  in  Lozano  and  Smith  (2015). 

Although  it  is  early,  we  regard  this  as  a  potentially  landmark  algorithm,  with 
widespread  implications.  One,  this  algorithm  us  to  attempt  problems  that  have  been 
far  too  difficult  to  consider  prior  to  now,  such  as  interdicting  traveling  salesman 
problems.  Furthermore,  we  regard  this  as  the  key  missing  piece  that  we  needed  in 


order  to  solve  the  more  difficult  patrolling  problems  proposed  in  this  paper.  Two, 
this  idea  leads  to  new  possibilities  in  investigating  related  problems  that  are  also 
very  difficult.  These  include  bilevel  problems,  in  which  the  follower  seeks  to 
optimize  an  objective  that  does  not  necessarily  entail  hurting  the  leader,  but  such 
that  the  follower’s  decision  impacts  the  leader’s  objective.  Our  preliminary  results 
show  a  10-fold  speedup  compared  with  the  best  previous  algorithm  for  this 
problem,  when  implemented  on  the  same  machine. 

The  investigators  have  also  pursued  multilevel  work  on  integer  programs  using 
different  means  than  the  ones  above.  Prince  and  Smith  (2015)  consider  network 
location  problems  with  fortification  and  interdiction,  in  which  the  inner  problems 
are  integer  programs  but  can  be  reformulated  using  an  expanded  variable  set  as 
convex  optimization  problems.  Tadayon  and  Smith  (2015)  examine  robust 
optimization  problem  in  the  context  of  scheduling  problems,  which  have  heretofore 
gone  unexamined.  Hemmati  and  Smith  (2015)  actually  consider  bilevel  instead  of 
interdiction  problems,  and  use  a  technique  related  to  lifting  inequalities  to  obtain  a 
finitely  convergent  optimal  algorithm.  Another  pair  of  studies  that  we  have 
authored  on  securing  a  border  under  asymmetric  information  have  appeared  in  the 
prestigious  journals  Mathematical  Programming  and  Naval  Research  Logistics ;  Dr. 
Kelly  Sullivan  was  the  key  student  on  those  papers  (supported  by  DTRA)  and  has 
taken  a  faculty  position  as  an  Assistant  Professor  at  the  University  of  Arkansas. 

Finally,  Drs.  Thai  and  Smith  collaborated  on  an  influence  propagation  model,  which 
has  recently  been  accepted  for  publication  in  Computational  Optimization  and 
Applications.  In  this  model,  we  consider  a  two-stage  defender-attacker  game  that 
takes  place  on  a  network,  in  which  the  attacker  seeks  to  influence  as  many  nodes  as 
possible.  The  defender  acts  first  in  this  game  by  protecting  a  subset  of  nodes  that 
cannot  be  influenced  by  the  attacker.  With  full  knowledge  of  the  defender's  action, 
the  attacker  can  then  influence  an  initial  subset  of  unprotected  nodes.  As  above,  this 
defender-attacker  game  is  difficult  to  optimize  because  the  attacker's  problem  itself 
is  NP-hard  (since  a  special  case  of  that  problem  corresponds  to  the  dominating  set 
problem).  Our  research  provides  new  mathematical  and  computational  insights  for 
solving  these  problems  within  reasonable  computational  limits. 

Dynamic  network  problems  can  also  be  viewed  in  the  light  of  dynamic  interdiction 
games.  Here,  the  defender  makes  a  set  of  moves,  followed  by  an  attack,  which  is 
followed  by  another  round  of  defense/attack  moves  until  the  game  is  complete.  For 
instance,  in  the  dynamic  shortest  path  interdiction  (DSPI)  game  studied  in  Sefair 
and  Smith  (2015),  the  attacker  damages  some  arcs  (possibly  none)  the  defender 
moves  on  an  arc,  and  the  game  continues  by  alternating  those  two  such  actions  until 
the  defender  reaches  the  terminal  node.  Note  that  for  this  discussion,  the  attacker  is 
assumed  to  have  some  limit  b  of  arcs  that  it  can  damage. 

These  problems  are  very  difficult,  and  evidently  do  not  even  belong  to  NP.  They  are 
related  to  robust  optimization  and  interdiction  as  follows.  Interdiction  puts  the 
attacker  at  a  disadvantage,  by  having  to  expend  all  of  its  possible  attacks  before  the 


defender  moves.  Robust  optimization  gives  the  attacker  an  advantage  by  allowing 
the  attacker  to  damage  arcs  after  the  defender  has  committed  to  a  path.  Dynamic 
interdiction  is  somewhere  in  between,  where  the  attacker  metes  out  its  b  attacks  in 
response  to  the  path  taken  so  far  by  the  defender,  and  where  the  defender  adapts  its 
path  in  response  to  the  remaining  attacker  budget  and  set  of  attacked  arcs. 

Although  optimal  solutions  to  this  problem  are  extremely  difficult  to  characterize  in 
general,  it  is  possible  to  create  various  restrictions  and  relaxations  for  the  attacker 
that  permit  bounds  on  the  optimal  objective  to  be  obtained  in  a  reasonable  amount 
of  computational  time. 

Interestingly,  the  DSPI  is  solvable  in  polynomial  time  when  b  is  fixed.  By  contrast, 
the  dynamic  sequential  assignment  problem  with  interdiction  (DAI)  involves  a 
defender,  who  assigns  one  project  at  a  time  in  each  period,  one  period  at  a  time, 
until  all  projects  are  assigned.  The  attacker  increases  the  assignment  cost 
(depending  on  the  project-period  pair),  and  the  game  is  played  in  a  dynamic  fashion 
as  above.  A  similarity  between  DAI  and  DSPI  is  that  when  interdiction  is  not 
present,  both  defender  problems  are  solvable  in  polynomial  time.  However,  when 
the  interdictor  is  limited  to  a  single  attack,  DAI  becomes  strongly  NP-hard  (and  in 
fact  inapproximable),  whereas  DSPI  is  solvable  in  polynomial  time.  Sefair  and  Smith 
are  producing  a  paper  on  this  topic  currently;  Sefair’s  dissertation  was  successfully 
defended  on  these  and  other  topics  in  June  2015. 

The  military  applications  that  we  are  developing  here  also  translate  directly  to  many 
other  areas  that  benefit  from  network  models,  such  as  marketing,  social  network 
analysis,  supply  chain  operations,  and  so  on.  The  quantitative  analysis  that  we  are 
developing  should  be  an  important  complement  to  the  principles  established  in 
mathematics,  physics,  and  other  branches  of  engineering,  since  those  methods  form 
the  cornerstone  of  algorithms  that  extend  well  beyond  our  current  study.  Perhaps 
surprisingly,  our  work  in  complex  networks  and  clique  detection  is  important  in 
computational  neuroscience,  for  instance  in  the  study  of  brain  trauma  disorders. 


IV.2  Technical  Details 


In  this  section  of  our  report,  we  give  technical  details  for  ten  of  our  most  impactful  studies  sup¬ 
ported  by  DTRA.  These  ten  studies  are  available  in  the  archival  literature,  and  we  are  pleased  to 
offer  data  and  code  from  these  studies  to  our  colleagues. 


1  Geometric  Interdiction 


This  discussion  is  taken  from  Sullivan  and  Smith  (2014),  with  all  proofs  relegated  to  that  paper. 
We  consider  the  interdiction  of  a  capacitated  network  that  exists  in  Euclidean  space.  Nodes  in 
this  network  exist  at  a  point  in  space,  and  (directed)  arcs  connect  node  pairs  in  a  straight  line.  An 
opponent  wishes  to  maximize  flow  from  a  source  node  to  a  sink  node  across  the  network,  while 
an  interdictor  seeks  to  minimize  the  opponent’s  maximum  flow  by  choosing  multiple  locations  to 
attack.  In  this  problem,  attacks  are  made  at  points  in  (Euclidean)  space.  Damage  is  inflicted  on 
each  arc  by  reducing  its  capacity  as  a  function  of  the  distance  from  the  midpoint  of  the  arc  to  each 
attack.  We  refer  to  this  problem  as  the  Euclidean  maximum  flow  network  interdiction  problem 
(E-MFNIP).  While  distance  can  be  computed  according  to  any  norm,  we  focus  on  the  case  in 
which  distances  are  computed  by  Li-norms,  which  will  enable  us  to  derive  mixed-integer  linear 
programming  formulations.  Also,  we  assume  that  each  arc  capacity  is  a  function  of  the  distance 
from  the  center  of  the  arc  to  the  closest  attack  location.  We  provide  mathematical  programming- 
based  approaches  for  solving  E-MFNIP. 

The  motivation  for  studying  this  type  of  problem  is  due  to  the  prevalence  of  networks  in  complex 
systems  and  the  vulnerability  of  those  systems  to  attack.  For  instance,  networks  that  represent 
real-world  transportation,  logistics,  and  power  grid  systems  have  well-defined  geographical  char¬ 
acteristics.  These  systems  are  subject  to  disruptions  that  may  damage  multiple  components  in  the 
same  geographical  region.  Most  network  interdiction  research  neglects  any  geographical  charac¬ 
teristics,  focusing  instead  on  identifying  network  components  that  are  most  critical  to  sustaining 
functionality.  In  contrast,  our  methodology  explicitly  accounts  for  the  simultaneous  failure  of 
network  components  correlated  by  the  physical  location  of  an  attack.  Furthermore,  it  is  not  nec¬ 
essary  to  restrict  the  scope  of  problems  to  those  facing  intentional  attacks.  Physical  systems  are 
vulnerable  to  accidental  disruptions  due  to  non-malicious  events  such  as  natural  disasters  as  well, 
and  must  be  robust  enough  to  withstand  worst-case  disasters.  Hence,  although  there  is  no  entity 
that  actively  seeks  to  maximize  damage  in  such  a  setting,  it  is  still  necessary  to  understand  the 
worst-case  vulnerability  of  the  system. 

Fet  G(N,  A)  be  a  maximum  flow  network  having  node  set  N  =  (1 , ,n}  and  directed  arc  set 
A  C  N  x  N,  where  node  1  is  the  source  and  node  n  is  the  sink.  Fet  cl}  denote  the  capacity  of  arc 

(i,j)  e  A. 

The  maximum  flow  (denoted  u)  from  node  1  to  node  n  can  be  obtained  by  solving  the  following 


model,  which  represents  the  dual  of  a  traditional  maximum  flow  model: 


v  =  min  ^  (la) 

s.t.  Ui  —  Uj  +  Vij  >  0,  V(i,  j)  G  A,  (lb) 

ui  =  0,  un  =  1,  (lc) 

Vij>  0,  V(t,j)GA  (Id) 


Here,  Ui  denotes  the  dual  variable  associated  with  the  flow  balance  constraints  for  node  i  G  N,  and 
Vij  denotes  the  dual  variable  associated  with  the  capacity  constraint  on  arc  ( i ,  j )  G  A.  We  define  U 
to  be  the  feasibility  set  that  encompasses  constraints  ( lb)— (Id). 

In  our  problem,  the  interdictor  chooses  an  attack  Z  from  some  feasible  set  Z,  and  arc  capacities 
are  computed  according  to  a  function  8ij  :  Z  — >  M  for  all  (i,  j)  G  A. 

After  the  leader  selects  an  interdiction  Z  G  Z,  the  follower  maximizes  flow  on  the  resulting  net¬ 
work  in  which  ct]  is  replaced  by  8V](Z).  The  interdictor’s  problem  is  then  to  choose  an  interdiction 
that  minimizes  the  follower’s  maximum  flow,  which  can  be  stated  as: 

is*  =  min  ^2  3ij(Z)vij,  s.t.  ( u,v )  GW,  Z  G  Z.  (2) 


When  Sij  is  defined  nontrivially  (i.e.,  not  constant)  for  some  (i-j)  G  A,  this  model  is  nonlinear 
in  the  objective.  However,  when  Z  =  Z  is  fixed,  there  exists  an  optimal  solution  to  the  reduced 
version  of  Model  (2)  in  which  ry,  G  (0, 1}  for  all  (i,j)  G  A.  Imposing  these  restrictions,  we 
can  linearize  the  product  in  the  objective  function  by  defining  variables  Wij  for  each  (i-j)  G  A  to 
represent  the  product  8ij(Z)vij,  and  adding  the  inequalities 

Wij  >  8ij(Z)  -  Mij(l  -  v^),  V(i,  j)  G  A,  and  (3a) 

Wij  >  0,  V(i,j)eA,  (3b) 

where  A4l3  is  an  upper  bound  on  8l;)  (Z)  over  all  Z  G  Z.  The  resulting  formulation  is  a  MIP  that  is 
linearly  constrained  when  8ij  is  a  linear  function: 

is*  =  min  ^2  Wij ,  (4) 

(*j)eA 

s.t.  Constraints  (3a)  and  (3b),  (u,v)  G  IA,  Z  G  Z,  v^  G  (0, 1},  V(i,  j)  G  A. 


Specification  to  E-MFNIP  In  previous  research,  Z  G  Z  typically  consists  of  \A\  decisions,  each 
representing  the  amount  of  interdiction  imparted  on  an  arc.  E-MFNIP  differs  in  its  definition  of  Z: 
We  assume  that  G  has  physical  structure,  residing  in  g-dimensional  Euclidean  space,  and  that  at 
most  K  interdictions  are  made  at  points  on  and  around  G.  In  what  follows,  we  adopt  the  following 
notational  conventions: 

1.  For  any  positive  integer  s,  we  use  the  notation  [s]  to  refer  to  the  set  s}. 


2.  We  use  Z  to  refer  to  an  element  of  Z.  Thus  Z  suffices  to  represent  all  K  interdiction  locations. 

3.  We  use  z,  z,  zk,  and  any  other  adaptation  of  bold  z  to  refer  to  the  coordinates  of  a  potential 
interdiction  location  in  W. 


Hence,  an  element  Z  G  Z  may  be  represented  as  Z  =  [z1]  •  •  •  \zK],  where  zk  G  W,  \/k  G  [K],  is 
the  location  of  the  k-\h  interdiction.  For  simplicity,  we  assume  that  the  constraint  set  Z  is  given  as 

Z  =  {Z  G  RqxK  :  L  <  zk  <  U,  k  G  [K]},  (5) 

where  L  and  U  are  q- vectors.  Each  node  i  e  A'  is  located  at  point  z(i)  G  Rq,  and  each  arc  center 
(i,  j)  G  A  is  located  at  the  point  z(i,  j)  =  0.5(z(i)  +  z (j)).  (All  nodes  i  £  N  are  assumed  to 
satisfy  L  <  z(i)  <  U .)  We  assume  that  the  damage  inflicted  by  an  attack  on  an  arc  is  a  function 
of  the  distance  between  the  arc  and  the  attack  location.  For  simplicity  and  model  tractability,  we 
compute  distance  using  the  Manhattan  norm,  i.e.,  |z|| ,  =  YH=i  lzfc|-  We  observe  here  that  the 
resultsreadily  extend  to  other  convex  norms  with  suitable  modifications.  However,  using  (e.g.) 
the  Euclidean  norm  instead  of  the  Manhattan  norm  results  in  a  nonlinear  (convex)  model  that  is 
modestly  more  difficult  to  solve.  Note  also  that  the  Manhattan  norm  can  be  used  to  approximate 
Euclidean  distance,  but  at  the  risk  of  overestimating  distance  by  a  ratio  of  up  to  (2  —  y/2) / \/2. 

For  z  G  M9,  define  dij( z)  =  ||z  —  z{i,j)\\l  as  the  distance  between  z  and  arc  In  our  model, 
the  capacity  of  arc  (i,j)  is  determined  by  the  distance  of  the  closest  attack  to  z(i.j).  That  is, 
capacity  functions  are  of  the  form 


Sij(Z) 


fij 


min  diAzk)  , 

h£[K]  m  '  ’ 


(6) 


where  fy  :  M+  — y  M+  is  a  function  that  maps  distance  to  capacity.  When  K  =  1,  this  assumption 
is  intuitive.  When  K  >  1,  this  assumption  is  possibly  conservative  (from  the  interdictor’s  perspec¬ 
tive)  because  only  one  of  the  K  interdictions  influences  the  capacity  of  each  arc.  This  assumption 
may  be  justifiable,  though,  in  situations  where  each  arc  is  composed  of  several  structural  compo¬ 
nents  that  determine  the  arc’s  capacity,  and  where  each  component  fails  due  to  varying  thresholds 
of  disruptions.  Thus,  less  severe  disruptions  (given  by  attacks  that  are  farther  away  than  the  closest 
attack)  are  only  capable  of  affecting  the  same  components  that  failed  due  to  the  closest  attack,  and 
hence  the  arc’s  capacity  depends  only  on  the  closest  attack  location. 


E-MFNIP  is  the  problem  that  results  when  Z  and  5  are  defined  as  in  (5)  and  (6),  respectively.  We 
define  is* E  as  the  optimal  objective  value  to  E-MFNIP. 


We  now  specialize  (4)  to  model  E-MFNIP  as  a  MIP  having  a  convex  continuous  relaxation  under 
a  certain  class  of  /-functions.  We  assume  that  ftJ  is  given  as  the  minimum  of  some  T  functions, 
i.e., 

fij(d)  =  mW-(d),  (7) 

te[T] 

where  gjj  :  M+  — >  M+  is  convex  and  nondecreasing  for  each  t  G  [T],  As  we  will  demonstrate,  this 
model  allows  us  to  construct  piecewise-convex  capacity  functions  of  distance. 


Define  h\  -  =  g\3  o  and  note  that  h\3  is  a  convex  function  because  g\-  and  are  convex  and  g\- 
is  nondecreasing.  Moreover,  observe  that  can  be  represented  as 


Sa(Z)  =  min  g\j 


min  diA zk) 

ke[K]K  J 


=  min 
te[T\,ke[K] 


Sij  °  dij(zk ) 


=  min 

te[T],ke[K] 


(8a) 

(8b) 

(8c) 


where  (8b)  follows  because  gj3  is  nondecreasing. 


Define  A tkj  to  equal  1  if  the  minimum  in  (8b)  is  achieved  by  t  G  [T]  and  k  G  [K]  and  Xj1-  =  0 
otherwise.  Using  the  A-variables,  dl3  can  be  expressed  as 


dij(Z)  =  min  _/'!-./(zA')|  A'}'.  (9a) 

te[T\,ke[K] 

s.t.  AS  =  1  and  AS  e  {o,  1}  Vf  g  [T],  k  g  [it:].  (9b) 

te[T],fee[M 

This  expression  could  be  substituted  for  SKI  in  Model  (4)  to  obtain  a  valid  formulation.  Fur¬ 
thermore,  observe  that  decreasing  Si3(Z)  relaxes  (3a),  which  is  the  only  place  Si3(Z)  appears  in 
Model  (4).  Thus,  the  minimization  operator  can  be  dropped  from  (9),  because  an  optimal  so¬ 
lution  will  always  exist  in  which  Sij(Z )  takes  its  smallest  value  allowed  by  (9).  The  resulting 
mixed-integer  nonlinear  program  (MINLP)  minimizes  JjU  J)G/i  Wij  subject  to  (a,  v)  G  U,  Z  G  Z, 
v  G  {0, 1}IAL  and  (3b)  as  well  as 


Wij  > 

[^ij(zfe)]  ^lj  ~  Mij(l  —  Vij),  G  A, 

(10a) 

te[T],ke[K] 

E  E 

=  1,  V(i,j)eA,  and 

(10b) 

te[T],ke[K] 

AS  e  {0, 1}, 

V(iJ)  eA,te  [ T ],  k  G  [K\, 

(10c) 

where  uy,  naturally  takes  the  least  possible  value  allowed  by  (10a). 

To  linearize  (10a),  let  <f>lk  represent  the  product  \htij( zA)]  \tkj  and  introduce  inequalities  similar  to 
(3)  to  obtain  the  following  model,  valid  for  any  Mk  such  that  Mk  >  h\-{ z),  VL  <  z  <  U,  (i,j)  G 
A,  t  G  [T]. 


v*h  =  min  ^2  wa 
( i,j)eA 

s.t.  (u,  v )  G  U, 


>  E 

te[T],ke[K] 

Wij>  0,  V(i,j)  G  A, 


Vij), 


G  A, 


(11a) 


(lib) 


(He) 


A“  =  l,  V(i,j)  £  A,  (lid) 

t£[T],k£[K] 

<t>ij  >  h%{zk)  -  Mj.(  1  -  Ag),  V(i,j)  e  A,  t  e  [T],  k  e  [X],  (lie) 
$f>0,  V(i,j)eA,  te[T],  ke[K],  (Ilf) 

vij  g  (0, 1},  V(«,j)ei,  (llg) 

Ag  e  {0,1},  V(i,  j)  eA,te  [T],  k  e  [K],  (llh) 

z  ez. 


As  before,  Model  (11)  is  a  MINLP,  but  this  time  its  continuous  relaxation  is  convex  (because  all 
/i-functions  are  convex).  These  tractable  continuous  relaxations  can  be  used  to  solve  (11)  via,  e.g., 
branch-and-bound  so  long  as  all  /-functions  can  be  expressed  as  (7). 


Solving  over  a  General  Capacity  Function.  In  many  applications,  the  /-functions  cannot  be 
represented  in  the  form  of  (7).  In  the  remainder  of  this  discussion,  we  outline  a  procedure  for 
using  Model  (11)  to  lower-bound  the  optimal  E-MFNIP  objective  value  by  defining  appropriate 
piecewise-linear  ^-functions. 

We  assume  the  true  5-functions  take  the  form  of  (6),  with  /  being  nondecreasing  and  concave. 
These  assumptions  intuitively  match  what  one  would  expect  from  the  behavior  of  a  realistic  inter¬ 
diction:  Capacity  increases  as  the  interdiction  moves  farther  away  from  an  arc  (nondecreasing), 
and  a  small  change  in  interdiction  location  is  more  likely  to  have  a  pronounced  impact  on  nearby 
arcs  than  on  far  away  arcs  (concave).  If  /  is  also  piecewise-linear,  Model  (11)  becomes  an  exact 
model  using  linear  ^-functions.  If  /  is  not  piecewise-linear,  ^-functions  can  be  selected  to  ensure 
that  (11)  provides  a  lower  bound  on  the  optimal  E-MFNIP  objective. 

We  now  examine  the  following  technique  for  approximating  5ij  -functions  via  piecewise-linear  g,j- 
functions.  Suppose  breakpoints  a0,  ■ . . ,  «r  are  given  such  that  0  =  a0  <  a\  <  ■  ■  ■  <  clt,  and 
d,j(z)  <  aT  for  all  L  <  z  <  U.  For  each  t  6  [T],  let  be  the  linear  function  that  approximates 
fij  and  is  tight  at  at-i  and  at,  i.e., 

g‘i(d)  =  —  ~  /(a‘-‘)  (d  -  at-i)  +  /(a,_,).  (12) 

—  (h- 1 


Theorem  1  Let  f  be  concave  and  nondecreasing,  and  suppose  gd  is  given  as  in  (12).  Then  (11) 
defined  with  h\rj  =  g\-  o  dtJ  provides  a  lower  bound  for  E-MFNIP,  i.e.,  u*h  <  u*E. 


Remark  1.  It  is  possible  to  refine  the  ^-functions  dynamically  within  the  solution  of  (11)  to  ob¬ 
tain  a  better  approximation  for  E-MFNIP.  These  functions  can  be  dynamically  adjusted  by  adding 
breakpoints  and  segments  to  refine  our  approximation  of  the  /-functions,  based  on  solutions  ob¬ 
tained  from  previous  relaxations  (e.g.,  as  pioneered  by  Falk  and  Soland  in  1969).  However,  this 
approach  requires  the  iterative  solution  of  the  lower-bounding  integer  programs  (11).  Our  expe¬ 
rience  indicates  that  each  integer  program  (11)  is  itself  very  difficult  to  solve.  The  computational 
difficulties  associated  with  this  approach  motivate  an  alternative  algorithm  below.  □ 


Discrete  Models.  As  an  alternative,  we  also  develop  a  methodology  for  generating  solutions  to 
E-MFNIP  based  on  replacing  the  continuous  set  Z  C  WxK  with  a  discrete  set  of  locations,  a 
subset  of  which  will  be  attacked  by  the  leader.  The  resulting  integer  program  is  a  restriction  of  (4); 
therefore,  all  feasible  solutions  to  this  problem  yield  upper  bounds  on  z/*£.  We  can  then  propose  a 
modification  of  this  model  that  provides  a  lower  bound  on  u*E  by  relaxing  the  capacity  functions. 

Define  R  =  (z  £  W  :  L  <  z  <  U}  and  consider  a  model  that  selects  K  attacks  from  among  a 
finite  set  of  candidate  locations  (z p}pep  indexed  over  a  set  P,  where  |P|  >  K  and  zp  £  R.  Vp  £  P. 
(Henceforth,  P  will  be  used  to  index  a  set  of  candidate  locations,  and  the  z-notation  will  refer 
exclusively  to  the  coordinates  of  a  candidate  location.) 

Suppose  interdictions  are  placed  at  locations  S  C  P,  where  S  =  K.  From  (6),  the  resulting 
capacity  of  arc  (i,j)  £  A  is  given  by  fl3[m\npeS  dl3(zp)\  =  minpeS  /ii[dij-(zp)],  because  fl3  : 
M_  — y  R  |  is  nondecreasing.  Given  P,  values  c3/J  =  f,3  [dl-J(zp)]  can  be  computed  a  priori  for  each 
p6f  and  treated  as  constants;  thus,  the  objective  is  to  select  S  C  P  that  minimizes  the  maximum 
flow  over  a  graph  in  which  the  capacity  of  arc  (i,j)  is  minpe,s{c?}.  We  refer  to  this  discretized 
problem  as  DE-MFNIP.  To  formulate  DE-MFNIP  as  a  MIP,  let  variables  yp  equal  one  if  location 
p  6  Pis  attacked  and  zero  otherwise.  The  y-variables  are  constrained  to  be  elements  of  the  set 
Y  =  {y  £  {0, 1}|P|  :  J2P£PyP  =  K}-  For  each  (i  ,  j )  £  A,  define  cl3  =  maxpe P{c?-}  and  observe 
that  the  capacity  of  arc  (i,j)  is  min Pep{cij  —  {ct]  —  cJY)yp}.  Given  y  £  Y,  the  follower  solves 
its  maximum  flow  problem  with  capacity  constraints  replaced  by  xi3  <  c,3  —  (c,3  —  d’3)yp,  Vp  £ 
P,  where  xl3  is  a  variable  specifying  how  much  flow  traverses  arc  (i,  j).  Define  lywiy)  as  the 
maximum  flow  resulting  from  any  y  £  Y .  The  value  of  vde(v)  can  be  obtained  alternatively  by 
solving  the  following  dual  model,  where  yP  is  the  dual  variable  associated  with  the  new  capacity 
constraints: 


VDs(y)  =  min  ~  (c‘j  ~ ,Jii]ypYij- 

(ij)eA  P&P 

s.t.  (u,  v )  £  U, 

peP 


(13a) 

(13b) 

(13c) 


Model  (13)  is  a  linear  program  given  y;  thus,  if  (13)  has  an  optimal  solution,  it  must  have  one 
that  is  complementary  slack  with  an  optimal  solution  to  its  dual.  Hence,  adding  the  constraints 
jfj  <  yp.  V(i,  j)  £  A.  p  £  P.  does  not  change  the  optimal  objective  value.  (To  see  this  formally, 
suppose  that  yp  =  0  but  yf  =  1  in  some  optimal  solution.  Fet  p'  £  P  be  such  that  yp'  =  1.  By 
setting  yP  =  0  and  y?-  =  1  instead,  we  retain  feasibility  while  reducing  the  objective  value  of  the 
solution.  Hence,  it  is  valid  to  set  yP  <  yp .)  This  relationship  also  permits  us  to  set  7  i3yp  =  ip3, 
because  yf-  <  yp  and  yp  £  (0, 1}.  We  now  model  DE-MFNIP  as  the  following  MIP: 


DE(P):  v*de(P)  —  min  £  £«  (14a) 

( i,j)eApeP 
s.t.  (u,  v )  £  U, 

=  g  a > 

p&p 


(14b) 

(14c) 


0<ifj<yp,  V(//)g  A,PeP,  (l4d) 

y  G  Y.  (14e) 

Integer  restrictions  need  not  be  placed  on  variables  u,  v,  and  7  in  Model  (14),  as  proven  in  the 
following  theorem. 

Theorem  2  There  exists  an  optimal  solution  to  Model  (14)  such  that  all  u-,  v-,  and  7- variables 
are  binary -valued. 

Theorem  3  Ifzp  G  11,  dp  G  P,  then  iv*DE(P)  >  u*E. 

For  a  >  0,  the  function  cf;(a)  =  f,:j  |max{0,  dl:J(zp)  —  a}]  provides  a  lower  bound  for  c?-(= 
fij°dij(zp ))  because  fl}  is  nondecreasing.  By  replacing  fij(d)  in  (14)  with  f,:j  [max{0,  d  —  a}],  we 
obtain  a  relaxed  model  that  will  be  useful  in  solving  E-MFNIP.  The  function  ftJ  [max{0,  d  —  a}] 
lower-bounds  fij(d )  by  “stretching”  the  true  capacity  function  away  from  the  attack  location  by 
radius  a.  Let  radii  ap  >  0  be  given  for  each  p  G  P  and  consider  the  model  DE(P,  a)  that  results 
from  replacing  cptJ  in  Model  (14)  with  <Jll{op): 

DE(P,  a):  u*DE(P,  a)  =  min  (15) 

(Pj)eApeP 

s.t.  Constraints  (14c)-(14e). 

When  ap  =  0,  Vp  G  P,  DE(P,  a)  is  identical  to  Model  (14);  thus,  u*de(P)  =  v*de{P,  0). 

DE-MFNIP  is  equivalent  to  the  version  of  E-MFNIP  that  would  result  from  restricting  each  zk  to 
come  from  {zp}peP  instead  of  from  R.  When  ap  >  0,  we  have  that  c?-( 0)  >  cC  (ap),  dp  G  P 
and  (i,  j)  G  A.  This  raises  the  following  question:  How  large  must  ap  be  before  we  can  guarantee 
that  is*E  >  Y De(P.  o ) ?  To  address  this  question,  for  p  G  P  and  a  >  0,  define  B(p,a )  as  the 
(one-norm)  ball  around  zp  with  radius  a,  i.e.,  B(p,  a)  =  (z  G  W  :  ||zp  —  z||x  <  a}.  Also,  given 

any  finite  set  of  candidate  points  P  and  a  vector  a  G  define  P(P,  a )  =  U p£pB(p,  ap). 

Theorem  4  Suppose  {z p}pep  and  a  G  are  given  such  that  zp  G  P,  dp  G  P.  If  R  C  B(P,  a), 
then  iv* e  >  v*de(P,  «)• 

Combining  the  results  of  Theorems  3  and  4,  we  have  that  u* DF(P.  a )  <  u*E  <  u*DE{P)  for  any  a 
and  P  such  that  (z p}pep  C  R  C  B(P,a).  Under  modest  assumptions  on  the  /-functions,  P  and 
a  may  be  chosen  to  guarantee  that  p*de(P)  -  u* i,F{P.  a)  is  arbitrarily  small  (providing  arbitrarily 
tight  upper  and  lower  bounds  for  iv*E),  as  proven  in  the  following  theorem. 

Theorem  5  Let  {zp}peP  and  a  G  be  given  such  that  zp  G  R,  dp  G  P,  and  let  a  >  0  be  given 
such  that  ap  <  a.  dp  G  P.  For  each  ( i,j )  G  A,  suppose  fi;j  is  Lipschitz  continuous  and  define 
Tij  >  0  as  the  corresponding  Lipschitz  constant.  Also,  define  t*  as  the  weight  of  the  maximum 
weighted  1-n  cut  over  G(N,  A)  with  arc  weights  t%3,  d(i,j )  G  A.  Then  iv*DE(P)  —  iv*de{P ,  cc)  < 
ar*. 


Theorem  5  guarantees  that,  with  a  large  enough  P-set  and  small  enough  a-valucs,  the  lower  bound 
provided  by  v*DE(P,  a)  is  arbitrarily  close  to  v*E.  However,  obtaining  a  lower  bound  in  this  fashion 
is  often  impractical  because  the  difficulty  associated  with  solving  DE-MFNIP  grows  quickly  as 
P  increases.  We  propose  an  alternative  technique  for  developing  tight  lower  bounds  based  on 
iteratively  building  the  set  P.  Towards  this  end,  we  now  prove  a  strengthened  version  of  Theorem  5 
that  will  be  used  to  establish  convergence  of  our  algorithm. 

Corollary  1  Let  P  and  a  be  given  as  in  Theorem  5,  and  let  (u,  v.  y,  7)  be  a  binary-valued  optimal 
solution  to  DE(P,  a).  The  relationship  v*de(P)  ~  v*  nF{P.  a)  <  ar*  is  valid  for  any  a  such  that 
a  >  ap  for  all  p  e  P  such  that  If  =  1. 

From  Corollary  1,  we  know  that  the  optimal  objective  value  for  DE(P,  a)  is  within  ar*  of  u*E, 
where  a  is  the  largest  radius  for  any  candidate  point  that  was  attacked  in  the  optimal  solution 
to  DE(P,  a).  We  now  prove  conditions  under  which  modification  of  the  set  P  guarantees  that 
v*de(P,  ol)  will  not  decrease.  This  result,  when  combined  with  Corollary  1,  gives  rise  to  an  exact 
algorithm  for  solving  E-MFNIP. 

Theorem  6  Let  P1,  P2,  and  {p*}  be  disjoint  index  sets  with  zp  e  R  and  ap  >0,  Vp  G  P1  U  P2  U 
{p*},  and  suppose  R  C  B(P 1  U  (p*},a).  IfB(P2,a)  =  B(p*,ap*),  then  u*DE(P1  U  { p*},a )  < 
/^uPVjo*, 

An  implication  of  Theorem  6  is  that  the  contents  of  P  can  be  modified  in  such  a  way  that  promotes 
an  increase  in  u*DE(P,  a)  without  losing  the  property  that  u*DE(P,  a )  <  u*E.  This  result  gives  rise 
to  a  methodology  for  solving  E-MFNIP,  which  we  describe  below. 


Discretize-and-Refine  Solution  Methodology.  We  now  describe  how  (14)  can  be  used  to  solve 
instances  of  E-MFNIP.  The  method  described  here  is  applicable  for  general  q,  but  our  focus  is  on 
problems  in  which  q  =  2  (e.g.,  as  would  be  the  case  in  power  grid,  telecommunications  network, 
and  transportation  settings). 

First,  specify  an  initial  set  of  points  (zp}pep0  and  values  >  0,  Vp  6  P0,  such  that  R  C 
P(P0,  a0).  An  initial  lower  bound  for  u*E  can  be  obtained  by  solving  DE(P0,  a0).  Solving  this 
problem  reveals  an  initial  set  of  attack  locations  that  are  optimal  for  the  relaxed  problem.  Next,  set 
P0  is  modified  (and  renamed  Pi)  to  consider  a  higher  density  of  candidate  locations  surrounding 
locations  that  were  optimal  for  DE(P0,  «0).  Corresponding  01 -values  are  assigned  to  the  new  ele¬ 
ments  of  Pi  in  accordance  with  the  assumptions  of  Theorem  6  so  that  is*DE(Po,  «o)  <  v*De(Pi,  on). 
In  this  fashion,  the  lower  bound  is  iteratively  improved  until  it  is  within  some  acceptable  tolerance 
gap  of  a  known  upper  bound. 

Upper  bounds  for  u*E  are  obtained  by  solving  DE(P)  for  any  P  (see  Theorem  3).  We  now  provide 
a  formal  description  of  our  discretize-and-refine  algorithm. 

1.  Select  z,p  G  R  and  ap0  for  each  p  e  P0,  such  that  R  C  P(P0,  ap).  Set  UB  =  00  and  iteration 
counter  s  =  0.  Fet  e  >  0  be  a  given  tolerance  parameter. 


2.  Solve  DE (Ps)  and  obtain  an  optimal  solution  (y,  u,  v,  7)  and  upper  bound  v*DE(Ps).  Define 
P  =  {p  G  Ps  :  yp  =  1}. 

3.  If  is* de(Ps)  ^  UB,  then  set  UB  =  is* de(Ps) >  arid  record  an  incumbent  solution  of  (zP}PeP- 

4.  Solve  DE(PS,  as)  and  obtain  an  optimal  solution  (y,  u,  v,  7)  and  lower  bound  is*DE(Ps,  «s). 
Define  P  =  {p  <E  Ps  :  yp  =  1}. 

5.  If  UB  —  is*DE(Ps,  01  s)  <  £,  then  terminate  the  algorithm  with  near  optimal  attack  locations 
given  by  the  incumbent  solution. 

6.  Set  Ps+ 1  =  PS\P.  For  each  p  e  PS\P,  set  ofs+1  =  af.  For  each  p  e  P: 

(a)  Construct  2 q  new  points  defined  over  indices  p\  and  pf  for  t  e  [q].  For  £  e  [7] ,  define 
zpe  =  zp  +  (ap/q)e^,  and  zA  =  z,p  —  (ap/q)e£.  (Note:  is  the  g-vector  with  a  one  in 
component  £  and  zeros  in  all  other  components.)  Add  jp  and  pj  to  Ps+1  for  each  i  G  [q]. 

(b)  Define  ap/+1  =  a/+l  =  ap(  1  -  1/q),  Vf  e  [g]. 

7.  Set  s  =  s  +  1  and  return  to  Step  2. 

In  moving  from  iteration  s  to  iteration  s  +  1,  the  property  that  R  C  P(Ps+i,as+1)  is  main¬ 
tained  because  (i)  R  C  B(Ps,as)  and  (ii)  B(p,as)  C  P({p/}te[g]  U  {p7}<e[?]>  ««+i).  e 

Thus,  we  guarantee  that  is*de{Ps,  as)  <  Vs,  by  Theorem  4.  Moreover,  U/g^  (B(fp,  ap , )  U 

a£+i))  =  B(p,  af);  thus,  /UD£(P0,  «o)  <  v*De{P\,  «i)  <  ■  ■  ■  <  v*de(Ps,  as)  <  u*E,  Vs,  by 

Theorem  6.  We  now  comment  on  the  selection  of  P0  and  o-q,  followed  by  a  proof  of  convergence. 


For  q  =  2  choosing  P0  as  in  Remark  2  guarantees  R  C  P(P0,a0)  with  no  overlap  between  the 
interior  of  B(p,  «[))  and  B(p,  op),  for  any  distinct  p.  p  7  P0.  (In  fact,  this  property  is  preserved 
by  the  updates  in  Steps  6  and  7,  implying  for  any  iteration  s  >  0  that  there  is  no  overlap  between 
B(p,ap)  and  B(p,a f),  for  any  distinct  p,p  e  Ps.)  For  g  >  2,  some  overlap  is  inevitable.  (For 
instance,  in  the  case  of  g  =  3,  the  of  B(p,  a )  is  4a3/3.  However,  p  refines  into  six  new  points  with 
radius  2a/3:  The  combined  volume  of  the  resulting  six  Lx-norm  balls  is  6(4/3)  (2a/3)3  =  64a3/27, 
which  is  78%  greater  than  the  volume  occupied  by  B(p,  a).)  This  result  induces  some  measure  of 
inefficiency,  but  the  algorithm  remains  convergent,  as  we  now  prove. 


Theorem  7  Suppose  r  >  0  is  fixed  and  P0  is  chosen  as  described  in  Remark  2.  If  ftJ  satisfies 
the  assumptions  of  Theorem  5  for  each  (■ i,j )  G  A  ( and  the  definition  of  t*  from  Theorem  5  ap¬ 
plies  as  well),  then  the  discretize-and-refine  algorithm  converges  to  an  e-optimal  solution  within 
|  Po|  £f-0W  iterations,  where  B  =  [log1_  i/q(z/r*r)]- 

We  now  illustrate  our  discretize-and-refine  algorithm  by  applying  it  to  a  major  fiber-optic  net¬ 
work,  obtained  from  Neumayer  (2012).  In  the  network,  there  are  170  nodes  representing  US 
cities  and  230  undirected  arcs  connecting  pairs  of  cities.  The  network  is  depicted  in  Figure  1. 


Three  nodes  (Chicago,  Houston,  and  San  Francisco),  indicated  by  large  circles,  are  designated 
as  sources  and  three  nodes  (Atlanta,  Orlando,  and  Washington,  D.C.),  indicated  by  large  dia¬ 
monds,  are  designated  as  sinks.  The  network  is  converted  into  a  directed  network  by  replacing 
each  undirected  arc  with  two  directed  arcs,  one  in  each  direction.  Latitude/longitude  coordinates 
are  used  to  establish  node  coordinates  z(i),  and  arc  capacities  are  computed  using  the  functions 
fij(d)  =  min{l,  0.2 d},  ( i,j )  G  A,  where  d  corresponds  to  the  distance  to  the  nearest  attack.  Note 
that  the  nominal  capacity  of  each  arc  is  1,  and  an  arc’s  capacity  can  be  decreased  to  zero  if  an  inter¬ 
diction  is  placed  on  its  midpoint.  In  Figure  1,  the  thickened  arcs  (in  Ohio  and  Arkansas)  represent 
the  arcs  that  would  be  interdicted  under  the  classical  MFNIP. 

The  node  coordinates  are  all  bounded  within  the  coordinates  25°W-50°W  and  70°N-125°N.  We 
assume  that  the  points  within  these  bounds  form  a  rectangle  (which  defines  the  feasible  interdiction 
location  set  R )  and  generate  P0  and  a:0  according  to  Remark  2  using  r  =  5.  We  then  apply  the 
discretize-and-refine  approach  to  solve  E-MFNIP  when  K  =  2. 

Figure  2  illustrates  the  initial  candidate  locations  {zp}pep0.  In  this  figure,  the  Lrnorm  ball  with 
radius  a.Q  has  been  drawn  around  each  candidate  solution,  the  center  (indicated  by  a  small  “plus” 
symbol)  of  which  marks  the  candidate  solution  itself.  Using  these  candidate  locations,  we  solve 
DE-MFNIP  to  compute  lower  and  upper  bounds  for  E-MFNIP.  The  solution  to  DE(P0,  a0)  yields  a 
lower  bound  of  0.084  for  E-MFNIP  and  includes  interdictions  at  (85°W,  40°N)  and  (90°W,  35°N). 
This  solution  is  depicted  in  Figure  2  by  stars  at  the  optimal  interdiction  locations.  The  lower- 
bounding  solution  is  then  used  to  refine  the  set  of  candidate  solutions,  producing  the  candidate  set 
Pi  that  will  be  used  in  the  next  iteration. 

Figure  3  depicts  Pi  along  with  the  obtained  lower-bounding  solution,  which  places  interdictions 
at  (87.5°W,  40°N)  and  (90°W,  32.5°N).  This  solution  is  then  refined  to  obtained  P2  (illustrated 
in  Figure  4),  which  results  in  interdiction  locations  of  (85°W,  42.5°N)  and  (95°W,  30°N)  and  im¬ 
proves  the  lower  bound  from  0.084  to  0.285.  In  each  successive  figure,  the  optimal  attack  locations 
from  the  previous  iteration  are  replaced  by  four  new  candidate  locations  having  smaller  radii. 


Figure  2:  Initial  candidate  interdiction  locations  (LB  =  0.084,  UB  =  2.814). 


Figure  3:  Candidate  interdiction  locations  after  one  iteration  (LB  =  0.285,  UB  =  2.38). 


Figure  4:  Candidate  interdiction  locations  after  two  iterations  (LB  =  0.575,  UB  =  2.356). 


Figure  5:  Near-optimal  interdiction  locations  after  62  iterations  (LB  =  1.941,  UB  =  1.957). 


This  process  is  repeated  until  the  upper  and  lower  bounds  are  sufficiently  close  (within  1%,  re¬ 
quiring  62  iterations).  The  resulting  solution,  illustrated  in  Figure  5,  contains  interdictions  at 
(85.9375°W,  41.9922°N)  and  (90.7812°W,  31.8359°N),  and  produces  a  lower  bound  of  1.941. 
This  example  also  illustrates  the  potential  benefit  of  accounting  for  network  geography  in  inter¬ 
diction  studies.  Attacking  the  midpoints  of  the  optimal  MFNIP  arcs  (the  thick  arcs  in  Figure  1) 
results  in  an  E-MFNIP  objective  of  2.785,  which  is  42%  greater  than  the  best  known  E-MFNIP 
solution. 


2  Identifying  Community  Structures 


We  consider  a  network  represented  as  an  undirected  graph  G  =  {V,  E)  consisting  of  n  =  \V\ 
vertices  and  m  =  \E\  edges.  The  adjacency  matrix  of  G  is  denoted  by  A  =  (A^  j,  where  At]  is 
the  weight  of  edge  (i,j)  and  Ar]  =  0  if  (i,j)  (j  E.  We  also  denote  the  (weighted)  degree  of  vertex 
i,  the  total  weights  of  edges  incident  at  i,  by  deg(i)  or,  in  short,  dlt. 

Community  structure  (CS)  is  a  division  of  the  vertices  in  V  into  a  collection  of  disjoint  subsets  of 
vertices  C  =  (Ci,  C2, . . . ,  C)}  where  (J*=1  Ci  =  V  and  l  is  the  total  number  of  identified  subsets. 
Each  subset  C*  C  V  is  called  a  community  and  we  wish  to  have  more  edges  connecting  vertices  in 
the  same  communities  than  edges  that  connect  vertices  in  different  communities.  The  modularity 
of  C  is  the  fraction  of  the  edges  that  fall  within  the  given  communities  minus  the  expected  number 
of  such  fraction  if  edges  were  distributed  at  random.  The  randomization  of  the  edges  is  done  so  as 
to  preserve  the  degree  of  each  vertex.  If  vertices  i  and  j  have  degrees  d,  and  dj,  then  the  expected 
number  of  edges  between  i  and  j  is  Thus,  the  modularity,  denoted  by  Q,  is  then 

Q ^  =  2M  ^ Aij  ~  2 M)5ij  (16) 

y 

where  M  is  the  total  edge  weights  and  the  element  dr]  of  the  membership  matrix  6  is  defined  as 


dij 


1,  if  i  and  j  are  in  the  same  community 
0,  otherwise 


The  modularity  values  can  be  either  positive  or  negative  and  the  higher  (positive)  modularity  values 
indicate  stronger  community  structures.  Therefore,  the  maximizing  modularity  problem  asks  us  to 
find  a  division  C  which  maximizes  the  modularity  value  Q(C). 

This  problem  is  different  from  the  partition  problem  as  we  do  not  know  the  total  number  of  parti¬ 
tions  /  beforehand.  Somewhat  surprisingly,  modularity  maximization  is  still  NP-complete  on  trees, 
one  of  the  simplest  graph  classes. 


Theorem  8  Modularity  maximization  on  trees  is  NP-complete. 


The  proof  has  been  presented  in  Dinh  and  Thai  (2015),  reducing  from  the  Subset-Sum  problem. 


Exact  Solutions.  Although  the  problem  is  in  NP  class,  efficient  algorithms  to  obtain  optimal  so¬ 
lutions  for  small  size  networks  are  still  of  interest.  We  have  presented  an  exact  algorithm  with  a 
run  time  of  0(n5)  to  the  problem  on  uniform-weighted  trees  Dinh  and  Thai  (2015).  The  algorithm 
is  based  on  the  dynamic  programming,  which  exploits  the  relationship  between  maximizing  mod¬ 
ularity  and  minimizing  the  sum-of-squares  of  component  volumes,  where  volume  of  a  component 
S  is  defined  as  vol(S')  =  Y^ves 


When  the  input  graph  is  not  a  tree,  we  provided  an  exact  solution  based  on  the  following  Integer 
Linear  Programming  (ILP). 


max 

s.t. 


— ——  BiAi  —  xa) 
2  M  ^  n  3 


Xij  Xjfc  Xih  ^  0 

Vi  <  j  <  k 

X{j  ~\~  Xjh  “j-  Xifo  ^  0 

Vi  <  j  <  k 

Xij  +  Xjh  H-  Xik  ^  0 

Vi  <  j  <  k 

Xij  G  [0, 1] 

i,j  E  [l..n] 

(17) 

(18) 

(19) 

(20) 
(21) 


where  Bt;]  =  At]  —  'jjj.  Constraints  (18),  (19),  and  (20)  are  well-known  triangle  inequalities  that 
guarantee  the  values  of  are  consistent  to  each  other.  They  imply  the  following  transitivity:  if  i 
and  j  are  in  the  same  community  and  j  and  k  are  in  the  same  community,  then  so  are  i  and  k.  By 
definition,  xa  =  0  Vi  and  can  be  removed  from  the  ILP  for  simplification. 

Therefore,  the  ILP  has  3(”)  =  0(n3)  constraints,  which  is  about  half  a  million  constraints  for 
a  network  of  100  vertices.  As  a  consequence,  the  sizes  of  solved  instances  were  limited  to  few 
hundred  nodes.  Along  this  direction,  we  have  presented  a  sparse  metric,  which  reduces  the  number 
of  constraints  to  0{n 2)  in  sparse  networks  where  m  =  0(n). 


Approximation  Algorithms.  When  G  is  a  tree,  the  problem  can  be  solved  by  a  polynomial  time 
approximation  scheme  (PTAS)  with  a  run  time  of  0{ne+1 )  for  e  >  0.  The  PTAS  is  solely  based 
on  the  following  observation.  Removing  k  —  1  edges  in  G  will  yields  k  connected  communities 
and  Qk  >  (1  —  j)QoPi  where  0 /,.  is  the  maximum  modularity  of  a  community  structure  with  k 
communities,  and  Qopt  is  the  optimal  solution.  The  PTAS  algorithm  for  maximizing  the  modularity 
follows  next. 


Algorithm.  PTAS  for  Maximizing  modularity  on  Trees 

1.  Given  e  >  0,  set  k  =  [7] 

2.  Qk  =  0 ,Ck  =  in 

3.  for  each  X  C  E  and  \X\  <  k  do 

4.  Find  connected  component  C\ ,  C2, . . . ,  Ck  in  T'  —  (  V.  E\ X) 

5.  LetCS  J  =  {C1,C2,...,Ck} 

6.  if  Q(J)  >  Qk  then 

7.  Qk  =  Q{J) 

8.  Ck  =  J 

9.  Return  Ck 


When  G  having  the  degree  distribution  that  follows  the  power-law,  i.e.,  the  fraction  of  nodes  in 
the  network  having  k  degrees  is  proportional  to  A;-7,  where  1  <  7  <  4,  the  problem  can  be 
approximated  to  a  constant  factor  for  7  >  2  and  up  to  an  0(1/  log  n)  when  1  <  7  <  2  (Dinh 
and  Thai,  2013).  We  propose  the  approximation  algorithm,  Low-Degree  Following  (LDF)  in  this 
regard. 

LDF  decides  for  each  vertex  u,  which  neighbor  to  follow,  and  if  u  follows  a  neighbor  v,  the 
algorithm  eventually  assigns  u  and  v  to  the  same  community.  The  algorithm  follows  three  rules  to 
assign  each  vertex  one  of  the  three  labels  leader ,  member,  or  orbiter  as  follows: 


1.  All  members  and  orbiters  have  degree  at  most  dQ,  for  some  predefined  parameter  d0. 

2.  There  are  only  two  types  of  following:  a  member  follows  a  leader  and  an  orbiter  follows  a 
member.  This  implies  that  members  cannot  follow  each  other  and  orbiters  cannot  directly  follow 
leaders. 

3.  All  neighbors  of  an  orbiter  must  be  members. 

The  algorithm  uses  three  sets  L,  M,  and  O  to  store  leaders,  members,  and  orbiters,  respectively, 
and  an  array  pt  to  store  which  neighbor  vertex  i  follows.  A  vertex  that  does  not  belong  to  any  of 
the  sets  L,  M,  or  O  is  said  to  be  unlabeled.  Initially,  L,  M,  and  O  are  empty  i.e.  all  vertices  are 
unlabeled  and  pi  =  0  for  all  i. 

At  each  step,  the  algorithm  considers  an  unlabeled  vertex  i  of  degree  at  most  d0.  If  there  is  a 
neighbor  j  e  N(i)\M  of  i  that  is  a  leader  or  an  unlabeled  vertex,  we  add  i  to  M  and  j  to  L,  if 
necessary,  and  set  i  to  follow  j,  p,  =  j.  Otherwise,  all  neighbors  of  i  must  be  labeled  with  member, 
thus,  we  can  add  i  to  the  set  of  orbiters  O  and  set  1  to  follow  an  arbitrary  neighbor  t. 


Finally,  two  types  of  communities  are  formed.  First,  all  the  members  that  follow  the  same  leader 
and  all  the  orbiters  that  follow  those  members  are  assigned  into  the  same  community.  Second, 
each  unlabeled  vertex  forms  a  singleton  community  of  size  one.  The  union  of  all  the  communities 
is  returned  as  the  community  structure  C. 

The  selection  of  do  is  important  to  derive  the  approximation  factor  as  do  needs  to  be  a  sufficient 
large  constant  that  is  still  relative  small  to  n  when  n  tends  to  infinity.  In  an  actual  implementation 
of  the  algorithm,  we  have  designed  an  automatic  selection  of  d,0  to  maximize  ().  LDF  can  be 
extended  to  solve  the  problem  in  directed  graphs  (Dinh  and  Thai,  2013). 

The  details  of  this  LDF  algorithm  is  presented  below. 

Algorithm.  Low-degree  Following  Algorithm  (Parameter  d0  G  N+) 

1.  L  4—  M  <—  0,0  4—  ®,pi  =  0  Vi  =  l..n 

2.  for  each  vertex  i  G  V  do 

3.  if  (ki  <  d0)  &  (i  ^  L  U  M)  then 

4.  if  N(i)  \  M  ±  0  then 

5.  Select  a  vertex  j  G  N (i)  \  M 

6.  Let  M  —  M  U  {i},  L  —  L  U  {j},Pi  —  j 

7.  else 

8.  Select  a  vertex  t  G  N(i) 

9.  0  =  0U  {i},Pi  =  t 

10.  C  =  0 

1 1.  for  each  vertex  i  e  V  \  (. M  U  O)  do 

12.  Ci  =  {i}  U  {j  G  M  \pj=i}U{teO\  pPt  =  i} 

13.  C  =  C  U  {Ci} 

14.  Return  C 


Furthermore,  in  some  cases,  communities  are  sharing  some  nodes  between  them,  referred  as  over¬ 
lapping  communities.  That  is,  a  person  or  a  node  can  belong  to  more  than  one  community.  There¬ 
fore,  we  further  designed  an  algorithm,  namely  DOCA  (Detecting  Overlapping  Community  Al¬ 
gorithm),  to  find  overlapping  network  modules  which  required  only  one  parameter,  indicating  the 
level  of  overlapping  (Nguyen  et  al.  201 1)  denoted  by  the  ration  j3. 


DOCA  consists  of  three  different  phases: 


1.  Detecting  Local  Communities 

2.  Combining  Overlapping  Communities 

3.  Revisit  Unassigned  Nodes 


In  the  first  phase,  we  identify  the  local  communities  by  maximizing  the  internal  density  of  each 
communities  (Nguyen  et  al.  2011).  The  density  based  function  can  be  defined  as  'D(C')  =  to 

identify  a  set  C  of  nodes  as  a  community.  The  more  C  approaches  a  clique  of  its  size,  the  higher 
its  density  value  T'(U).  Cin  and  Cout  denote  the  set  of  edges  having  both  endpoints  in  C  and  one 
endpoint  in  C,  respectively. 


The  threshold  on  the  internal  density  that  suffices  for  C  to  be  a  local  community  is  given  by 


r(C) 


yuy  Where  a(C) 


(22) 


We  term  a  group  of  nodes  C  C  V  a  local  community  if  its  internal  density  exceeds  a  threshold 
determined  based  only  on  C’s  size,  regardless  to  its  external  connections.  Of  course,  a  clique 
represents  a  perfect  local  community;  however,  we  do  not  restrict  our  starting  communities  to  be 
only  cliques.  Instead,  we  relax  them  to  be  “quasi-cliques”  which  can  overlap  with  each  other  and 
whose  detection  can  be  done  in  an  automatic  fashion.  The  phase  is  described  in  Alg.  1. 


Algorithm  1:  Detecting  Local  Communities 
Input  :  Network  G  =  (V.  E) 

Output:  Local  (or  raw)  community  structure  C  =  {C\,  C'2, . . . ,  Ok} 

1  C  =  0; 

2  for  (u,  v)  G  E  and  Com(u)  (T  Com(v )  =  0  do 

3  Let  Cuv  —  N(u)  fl  N(v)  U  {u,  u}; 

4  if  A (Cuv)  >  t(Cuv)  then 

5  C  i —  C  U  Cuv ; 

6  Update  Com(u )  and  Com(v ); 

7  end 

8  end _ 

As  soon  as  the  first  procedure  finishes,  the  raw  network  community  structure  can  be  pictured  as 
a  collection  of  (possibly  overlapped)  dense  parts  of  the  network  together  with  outliers.  As  some 
of  those  dense  parts  can  possibly  share  significant  common  substructures,  we  need  to  merge  them 
if  they  are  indeed  highly  overlapped.  In  order  to  do  so,  we  introduce  the  overlapping  score  of 

two  communities:  OS(Ct,  Q)  =  miTt{|c^c.|}  +  where  ^  =  Ci  n  Cr  Basica11^ 

OS(Ci,  Cj )  values  the  importance  of  the  common  nodes  and  connections  shared  between  C,  and 
Cj  to  the  smaller  community. 

The  second  phase  starts  out  by  examining  raw  communities  identified  from  the  first  phase  in  a 
bottom  up  manner.  In  this  procedure,  two  communities  Ci  and  Cj  are  combined  if  OSiC,  .  Cj)  >  (3. 
The  algorithm  is  described  in  Alg.  2. 


Algorithm  2:  Combining  Overlapping  Communities 
Input  :  Local  network  community  structure  C  =  { C\ .  C'2, ....  C'p} 

Output:  Combined  community  structure  C  =  {6'] ,  C'2, . . . ,  C, } 

1  C  =  C,  Done  G-  False; 

2  while  (7  Done)  do 

3  Done  G-  True; 

4  for  Cj  G  C  do 

s  Let  N(Ci)  =  {Cj  G  C\C3  0  C%  ±  0}; 

6  for  Cj  G  N(Ci)  do 

7  if  OC{Cj ,  C',j  >  [j  then 

^  Cmin{ i,j }  ^  Cj  U  Cj, 

9  C  i  C\CmaxS^i jj , 

10  Update  Com(u )  for  all  w  G  Q; 

11  Done  False; 

12  end 

13  end 

14  end 

is  end 

Even  when  the  above  two  procedures  are  executed,  there  would  still  exist  leftover  nodes  or  edges 
due  to  their  less  attraction  to  the  rest  of  the  network.  Because  of  its  size  constraint,  the  first 
procedure  skips  over  tiny  communities  of  sizes  less  than  four  and  thus,  may  leave  out  some  nodes 
unlabeled.  These  nodes  will  not  be  touched  in  the  second  phase  since  they  do  not  belong  to  any 
local  communities  and  consequently,  will  remain  unassigned  afterwards.  Therefore,  we  need  to 
revisit  those  nodes  to  either  group  them  into  appropriate  communities  or  classify  them  as  outliers 
based  on  their  connectivity  structures.  Alternatively,  this  process  can  be  thought  of  as  a  community 
trying  to  hire  adjacent  unassigned  nodes  which  are  similar  to  the  host  community.  To  this  end,  we 
need  a  community  fitness  function  in  order  to  quantify  the  similarity  between  a  node  u  and  a 

I  oin  I 

neighbor  community  C.  We  find  the  fitness  function  Fs  =  ^or  S  F  V.  Taking  into 

account  this  fitness  function,  a  community  C  will  keep  hiring  any  unassigned  adjacent  vertex  of 
maximum  similarity  in  a  greedy  manner,  provided  the  newly  joined  vertex  does  not  shrink  down 
the  community’s  current  fitness  value.  If  there  is  no  such  node,  C  is  defined  as  a  final  network 
community  shown  in  Alg.  3.  Simulations  showed  that  this  is  the  best  one  in  the  literature  (Nguyen 
et  al.  2011). 


3  Adaptively  Updating  Dynamic  Community  Structures 

Many  real  world  networks  are  dynamic  in  nature  where  elements  in  the  network  (vertices  and 
edges)  evolve  over  time.  In  this  project,  We  continued  studying  the  adaptive  identification  of 
community  structures,  focusing  on  the  following  question:  How  to  update  the  evolving  community 
structures  without  re-computing  it  from  scratch.  In  this  approach,  the  community  structure  (CS)  at 


Algorithm  3:  Revisit  Unassigned  Nodes 
Input  :  The  combined  community  structure  C  =  { C\ .  C'2, . . . ,  C[ } 

Output:  The  final  community  structure  C  =  { Cj .  C2,  ■ . . ,  Ck) 

1  C  =  C'; 

2  for  u  G  V  and  Com(u)  =  0  do 

3  Let  NC{u )  =  {Cj  G  C\u  is  adjacent  to  C j } ; 

4  for  Cj  G  NC(u)  do 

s  if  FCiuM  >  FCj  then 

6  Cj  G-  Cj  U  {«}; 

7  Com(u)  Com(u)  U  {j } ; 

8  end 

9  end 

10  if  Com(u )  =  0  then 

11  |  Classify  u  as  an  outlier; 

12  end 

13  end 

time  t  is  detected  based  on  the  community  structure  at  time  t  —  1  and  the  changes  in  the  network, 
instead  of  recomputing  it  directly  at  time  t  without  taking  advantages  of  a  current  solution  at  time 
t  —  1.  Along  this  direction,  we  have  devised  an  adaptive  approximation  algorithm  for  this  problem, 
published  in  Dinh  et  al.  (2013).  Indeed,  the  above  LDF  algorithm  described  in  before  can  be 
enhanced  to  cope  with  this  situation.  At  first  LDF  is  run  to  find  the  base  CS  at  time  0.  Then  at  each 
time  step,  we  adaptively  follow  and  unfollow  the  nodes  that  violate  the  condition  3  in  the  LDF 
algorithm.  We  provide  greater  detail  of  this  proposed  algorithm,  namely  A3CS,  below. 

A3CS  is  a  meta-algorithm  that  first  calls  A-Base  algorithm  to  find  the  community  structure  C(i)> 
of  the  first  network  snapshot  G^°\  then  iteratively  finds  community  structure  C(l>  at  time  point  t  by 
invoking  the  A-Adaptive  algorithm.  The  two  algorithms  A-Base  and  A-Adaptive  construct  the 
community  structure  via  assigning  values  for  two  arrays  label[i\  and  follow[i\. 

Algorithm.  A3CS  -  Adaptive  Approx.  Alg.  for 
CS 

1.  C(°)  =  A-Base(C(°)) 

2.  for  t  =  1  to  s  do 

3.  CW  =  A-Adaptive AG W) 

The  meaning  of  label  and  array  is  as  follow.  Each  node  i  is  labeled  with  either  leader,  follower, 
or  unlabeled  (also  denoted  with  0).  For  a  node  i  labeled  with  follower,  follow[i\  is  the  name  of 
the  leader  that  i  follows.  Precisely,  we  have 

i  if  label[i\  =  leader 

follow[i\  =  j  /  i  if  label[i\  =  follower  &  i  follows  j 
0  if  label[i\  =  0 


At  any  time  point  t,  the  community  structure  is  given  by  the  union  of  two  types  of  communities: 
1)  all  followers  that  follow  the  same  leader  are  assigned  into  the  same  community;  and  2)  each 
unlabeled  node  forms  a  singleton  community  of  size  one. 

At  the  heart  of  the  proposed  algorithms,  the  assigned  labels  satisfy  the  important  properties  stated 
in  the  following  lemma. 

Lemma  1  At  the  end  of  the  algorithms  A-Base  and  A-Adaptive,  the  following  properties  hold. 


1.  All  low-degree  nodes  i.e.,  nodes  with  degree  at  most  do  for  some  predefined  constant  do  >  0,  are 
labeled  either  with  leader  or  follower. 

2.  All  followers  are  low-degree  nodes. 

3.  Each  leader  is  followed  by  at  least  one  follower;  and  each  follower  follows  exactly  one  leader. 
Thus  followers  will  not  follow  each  other  or  unlabeled  nodes. 

The  intuition  to  this  lemma  will  be  explained  through  the  presentation  of  A-Base  and  A-Adaptive. 


Algorithm.  A-Base 

1.  label[i\  =  0,  follow[i ]  =  0  Vi  =  l..n 

2.  Sorted  nodes  in  non-decreasing  order  of  de¬ 
gree. 

3.  for  each  vertex  i  with  ki  <  do  do 

4.  if  label[i]  =  0  then 

5.  FOLLOW_NEIGHBOR(i) 

6.  Return  C =  (follow) 


A-Base.  This  algorithm  finds  the  community  structure  of  G(0)  via  labeling  nodes  in  the  network. 
Nodes  are  first  sorted  in  a  non-decreasing  order  of  degree,  and  then,  each  low-degree  and  unlabeled 
node  i  selects  one  of  its  neighbors  to  follow  using  the  FOLLOW  NEIGHBOR  algorithm,  in  which  the 
label[i\  and  the  follow[i\  are  assigned  accordingly.  We  can  verify  that  all  the  properties  in  Lemma 
1  hold  at  the  end  of  A-Base. 


Algorithm.  A-Adaptive  (C^  1\AG^) 

1.  for  each  edge  ( u,v )  £  A E®  do 

2.  Update  degree  of  nodes  u  and  v 

3.  for  each  vertex  i  appeal's  in  ACfl>  do 

4.  if  (ki  <  do)  &  (label\i\  =  0)  then 

5.  FOLLOW_NEIGHBOR(  i  ) 

6.  else  if  (ki  >  do)  &  (label[i\  =  follower) 

then 

7.  UNFOLLOW(  i  ) 

8.  Return  C ^  =  ( follow ) 

A-Adaptive.  This  algorithm  finds  the  community  structure  at  time  point  t  based  on  C(t^l>  and 
AG{t)  -  the  previous  community  structure  and  the  changes  in  the  network.  After  updating  the  node 
degrees  (lines  1  to  2),  the  algorithm  checks  all  nodes  that  appear  in  A G®  and  corrects  all  possible 
“mis-labeling”  caused  by  the  degree  changes.  Two  “mis-labeling”  cases  are  1)  low-degree  and 
unlabeled  nodes  as  the  results  of  removing  edges  (or  adding  new  nodes),  and  2)  follower  nodes 
with  the  degrees  higher  than  d0  as  the  results  of  adding  new  edges/nodes.  The  two  “mis-labeling” 
cases  are  corrected  using  FOLLOW.NEIGHBOR  and  UNFOLLOW  algorithms,  as  shown  in  lines  4  to  7. 


Algorithm.  FOLLOW_NEIGHBOR(  i ) 

1.  label[i]  =  follower 

2.  if  3j  £  N(i)  :  label[j ]  /  follower  then 

3.  if  label[j]  =  0  then  label[j]  =  leader 

4.  follow[i\  =  j 

5.  else 

6.  Select  a  random  j  £  A ( i ) 

7.  UNFOLLOW(j) 

8.  follow[i]  =  j,label[j]  =  leader 

9.  Update  the  modularity  value. 

FOLLOW  NEIGHBOR.  This  is  the  fundamental  procedure  in  A3CS.  Given  a  node  i.  the  algorithm 
identifies  a  neighbor  j  so  that  i  can  follow  j  without  violating  the  properties  of  Lemma  1.  Lines  3 
and  4  explore  the  case  when  we  can  find  a  non-follower  neighbor  j  of  i.  When  all  neighbors  of  i 
are  followers,  we  first  use  the  UNFOLLOW  algorithm  to  make  a  neighbor  j  of  i  unlabeled  or  labeled 
it  with  leader ,  and  only  then  we  can  let  i  follow  j  (lines  6  to  8). 


Algorithm.  UNFOLLOW(  i ) 

1.  Let  j  =  follow[i],label[i]  =  0 

2.  if  j  has  no  followers  then 

3.  if  kj  <  do  then 

4.  follow[j]  =  i,label\j]  =  follower 

5.  label[i\  =  leader 

6.  else  label\j]  =  0 

7.  Update  the  modularity  value. 

UNFOLLOW.  As  briefly  mentioned,  the  algorithm  UNFOLLOW  is  invoked  when  we  need  to  stop 
a  node  i  from  following  its  current  leader  j.  This  can  usually  be  done  by  simply  unlabeling  i. 
The  interesting  case  happens  when  i  is  the  only  follower  of  j  and  unlabeling  i  will  make  j  a 
leader  without  followers  (opposing  the  third  property  in  Lemma  1).  We  handle  this  case  by  either 
unlabeling  j  or  swapping  i  and  j’s  labels  together  with  making  j  follow  i  (lines  3  to  6). 

Many  real  world  networks  in  reality  are  highly  dynamic  and  thus,  their  communities  are  not  al¬ 
ways  disjoint  from  each  other.  Indeed,  their  communities  often  overlap  with  each  other  since  some 
active  nodes  can  participate  in  multiple  groups  at  the  same  time,  thereby  reassemble  the  concept 
of  overlapping  community  structure.  Furthermore,  most  practical  models  for  network  problems 
evolve  frequently  over  time  due  to  the  high  dynamics  of  participating  nodes.  Although  any  slight 
change  does  not  seem  to  have  a  significant  effect  on  the  network  structure,  the  evolution  of  the 
complex  network  over  a  long  duration  might  lead  to  an  unpredictable  transformation  of  its  com¬ 
munities,  particularly  when  they  can  overlap.  In  this  context,  we  further  investigated  the  evolution 
in  overlapping  community  structure  and  provided  the  first  adaptive  algorithm  to  adaptively  up¬ 
date  the  overlapping  network  modules.  This  work  is  published  in  Nguyen  et  al.  (PLoS  ONE  and 
MOBICOM). 

In  order  to  reflect  these  changes  to  a  complex  network,  its  underlying  graph  model  is  frequently 
updated  by  either  inserting  or  removing  a  node  or  a  set  of  nodes,  or  an  edge  or  a  set  of  edges. 
Scrutiny  into  these  events  reveals  that  the  introduction  or  removal  of  a  set  of  nodes  (or  edges)  can 
furthermore  be  decomposed  as  a  collection  of  node  (or  edge)  insertions  (or  removals),  in  which 
only  a  node  (or  only  an  edge)  is  inserted  (or  removed)  at  a  time.  Therefore,  changes  to  the  network 
at  each  time  step  can  be  viewed  as  a  collection  of  simpler  events  whose  details  are  as  follow: 

•  newNode  ( V  +  u):  A  new  node  u  and  its  adjacent  edge(s)  are  introduced 

•  removeNode  (V  —  u):  A  node  u  and  its  adjacent  edge(s)  are  removed  from  the  network. 

•  newEdge  (E  +  e):  A  new  edge  e  connecting  two  existing  nodes  is  introduced. 

•  remove  Edge  (E  —  e):  An  edge  e  in  the  network  is  removed. 


Our  adaptive  framework,  namely  Adaptive  Finding  Overlapping  Community  Structure  (AFOCS) 


Figure  6:  When  a  new  node  u  is  introduced,  u  could  gather  some  nodes  from  an  existing  commu¬ 
nity  (red)  to  form  a  new  community  (yellow) 


initially  requires  a  basic  community  structure  C0.  To  obtain  this  basic  structure,  we  apply  DOC  A 
algorithm  (Alg.  1,  Alg.  2)  at  the  first  network  snapshot,  i.e.  we  execute  DOC  A  on  the  network  G$ 
and  then  let  AFOCS  adaptively  handle  this  structure  as  the  network  evolves. 


Handling  a  new  node.  Let  us  discuss  the  first  case  when  a  new  node  u  and  its  associated  links 
are  introduced  to  the  network.  Possibilities  are  (1)  u  may  come  with  no  adjacent  edge  or  (2)  with 
many  of  them  connecting  one  or  more  possibly  overlapped  communities.  If  u  has  no  adjacent  edge, 
we  simply  join  u  in  the  set  of  outliers  and  preserve  the  current  community  structure. 

The  interesting  case  happens,  and  it  usually  does,  when  u  comes  with  multiple  links  connecting 
one  ore  more  existing  communities.  Since  network  communities  can  overlap  each  other,  we  need 
to  determine  which  ones  u  should  join  in  in  order  to  maximize  the  gained  internal  density.  But  how 
can  we  quickly  and  effectively  do  so?  By  Lemma  2,  we  give  a  necessary  condition  for  a  new  node 
in  order  to  join  in  an  existing  community,  i.e.  our  algorithm  will  join  node  u  in  C  if  the  number  of 
connections  u  has  to  C  suffices:  dui  >  However,  failing  to  satisfy  this  condition  does  not 

necessarily  imply  that  u  should  not  belong  to  C,  since  it  can  potentially  gather  some  substructure 
of  C  to  form  a  new  community  (Figure  6).  Thus,  we  also  need  to  handle  this  possibility.  Alg.  4 
presents  the  algorithm. 

Lemma  2  Suppose  u  is  a  newly  introduced  node  with  dui  connections  to  each  adjacent  community 

e2\C'i'ri\ 

Ci .  u  will  join  in  Ci  if  dui  >  jyyyry- 

The  analysis  of  Alg.  4  is  shown  by  Lemma  3.  In  particular,  we  show  that  this  procedure  achieves  at 
least  0.83%  internal  density  of  the  optimal  assignment  for  u,  given  the  prior  community  structure. 

Lemma  3  Alg.  4  produces  a  community  assignment  that,  prior  to  the  community  combination  pro¬ 
cess,  achieves  T'(Ct)  >  r( 4)  x  '■V  (O  PT('u)i)  where  OPT(u)t  is  the  optimal  community  assignment 
for  u  at  time  t,  given  the  prior  community  structure  C/_i. 


Handling  a  new  edge:  In  case  where  a  new  edge  e  =  (u,  v)  connecting  two  existing  vertices 
u  and  v  is  introduced,  we  divide  it  further  into  two  four  smaller  cases:  (1)  e  is  solely  inside  a 
single  community  C  (2)  e  is  within  the  intersection  of  two  (or  more)  communities  (3)  e  is  joining 
two  separated  communities  and  (4)  e  is  crossing  overlapped  communities.  If  e  is  totally  inside  a 


Algorithm  4:  Handling  a  new  node  u 


Input  :  The  current  community  structure  Ct- 1 
Output:  An  updated  structure  Ct. 

1  Ci,  CW*..,  Ck  <—  Adjacent  communities  of  u; 

2  for  %  =  1  to  k  do 

3  if  dui  >  pjbj;  then 

4  Cj<-CiU 

5  end 

6  else 

7  C  4r~  N(u)  n  Ci, 

8  if  'h(C)  >  t(C)  and  \C\  >  4  then 

9  |  Ci  Ci  U  {u}\ 

10  end 

11  end 

12  end 

13  /*Checking  new  community  from  outliers*/; 

14  for  v  G  C0  and  Com(y )  (T  Com(u )  =  0  do 

is  C  =  N(u)  fl  N(v); 

16  if  'T(C)  >  t(C)  and  \C\  >  4  then 

17  |  Define  C  a  new  community; 

is  end 

19  end 

20  Merging  overlapping  communities  on  Ci,  C2, Ck  and  6'0; 

21  Update  Ct\ 


(a) 


(b) 

Figure  7:  (a)  The  network  with  4  disjoint  communities  (b)  When  the  central  edge  is  added,  the 
central  nodes  form  a  new  community  (yellow) 


community  C,  its  presence  will  strengthen  C’s  internal  density  and  by  Lemma  4,  we  know  that 
adding  e  should  not  split  the  current  community  C  into  smaller  substructures.  The  same  reaction 
applies  in  the  second  subcase  when  e  is  within  the  intersection  of  two  communities  since  their  inner 
densities  are  both  increased.  Thus,  in  these  first  two  cases,  we  leave  the  current  network  structure 
intact. 


Algorithm  5:  Handling  a  new  edge  ( u ,  v) 


1 

2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 
19 


Input  :  The  current  community  structure  Ct- 1- 
Output:  An  updated  community  structure  Ct. 

if  ((u,  v)  G  a  single  community  OR  (u.  v)  G  Cu  D  Cv )  then 

Ct  Ct- 1; 

end 

else  if  Com(u )  (T  Com(v )  =  0  then 
C  «-  N(u)nN(v\, 
if  T(C)  >  t(C)  then 

Define  C  a  new  community; 

Check  for  combining  on  Com(u),  Com(v )  and  C; 

end 

else 

for  D  G  Com(u )  (or  D'  G  Com(v))  do 

if  V(D  U  M)  >  t(D)  (or  ^(D'  U  { u })  >  r(D'))  then 
j  D  D  U  {v }  (or  D'  ■k-  D'  U  {«}); 

end 

end 

Merging  overlapping  communities  on  D' s  (or  D’)\ 

end 

Update  Ct, 


Handling  the  last  two  subcases  is  complicated  since  any  of  them  can  either  have  no  effect  on  the 
current  network  structure  or  unpredictably  form  a  new  network  community,  and  furthermore  can 
overlap  or  merge  with  the  others  (Figure  7).  However,  there  is  still  a  possibility  that  the  introduction 


Figure  8:  (a)  Two  overlapped  communities  (b)  When  the  central  node  is  removed,  the  new  structure 
consists  of  two  disjoint  communities 


of  this  new  link,  together  with  some  substructure  of  Cu  or  Cv,  suffices  to  form  a  new  community 
that  can  overlap  with  not  only  Cu  and  Cv  but  also  with  some  of  the  others.  The  other  subcases  can 
be  handled  similarly.  Alg.  5  describe  this  procedure. 


Lemma  4  If  an  new  edge  (u,  v)  is  introduced  solely  inside  a  community  C,  it  should  not  split  C 
into  smaller  substructures. 


Removing  an  existing  node:  When  an  existing  node  u  is  about  to  be  removed  from  the  network, 
all  of  its  adjacent  edges  will  also  be  removed  as  a  consequence.  If  u  is  an  outlier,  we  can  sim¬ 
ply  exclude  u  and  its  corresponding  links  from  the  current  structure  and  safely  keep  the  network 
communities  unchanged. 

In  unfortunate  situations  where  u  is  not  an  outlier,  the  problem  becomes  very  challenging  in  the 
sense  that  the  resulting  community  is  complicated:  it  can  either  be  unchanged,  or  broken  into 
smaller  communities,  or  could  probably  be  merged  with  the  other  communities.  To  give  a  sense 
of  this  effect,  let’s  consider  two  examples  illustrated  in  Figure  8.  In  the  first  example,  when  C  is 
almost  a  full  clique,  the  removal  of  any  node  will  not  break  it  apart.  However,  if  we  a  remove  node 
that  tends  to  connect  the  others  within  a  community,  the  leftover  module  is  broken  into  a  smaller 
one  together  with  a  node  that  will  later  be  merged  to  one  of  its  nearby  communities.  Therefore, 
identifying  the  leftover  structure  of  C  is  a  crucial  task  once  a  vertex  u  in  C  is  removed. 


Algorithm  6:  Removing  a  node  u 
Input  :  The  current  community  structure  Ct- 
Output:  An  updated  structure  Ct. 

1  for  C  G  Com(u )  and  'k( C\{u })  <  r(C\{w})  do 

2  LC  G-  Local  communities  by  Alg  1  on 

3  for  C'i  G  LC  and  \Ci\  >4  do 

4  Si  G-  Nodes  such  that  'F(C'?;  U  Si)  >  r(Ci  U  St); 

5  Ci  Ci  U  Sp, 

6  end 

7  Merging  overlapping  communities  on  LC; 

8  end 

9  Update  Ct; 


To  quickly  handle  this  task,  we  first  examine  the  internal  density  of  C  excluding  the  removed  node 
u.  If  the  number  of  internal  connections  still  suffices,  e.g  ^(Cy-fu})  >  r(C\{u}),  we  can  safely 
keep  the  current  network  communities  intact.  Otherwise,  we  apply  Alg.  1  on  the  subgraph  induced 
by  G'\{i/}  to  quickly  identify  the  leftover  modules  in  C,  and  then  let  these  modules  hire  a  set  of 
unassigned  nodes  TfG'j  that  help  them  increasing  their  inner  densities.  Finally,  we  locally  check 
for  community  combination,  if  any,  by  using  an  algorithm  similar  to  Alg.  2. 


Removing  an  edge:  In  the  last  situation  when  an  edge  e  =  ( u ,  v)  is  about  to  be  removed,  we 
divide  it  further  into  four  subcases  similar  to  those  of  a  new  edge  (1)  e  is  between  two  disjoint 
communities  (2)  e  is  inside  a  sole  community  (3)  e  is  within  the  intersection  of  two  (or  more) 
communities  and  finally  (4)  e  is  crossing  overlapping  communities. 

In  the  first  subcase,  when  e  is  crossing  two  disjoint  communities,  its  removal  will  make  the  network 
structure  more  clear  (since  we  now  have  less  connections  between  groups),  and  thus,  the  current 
communities  should  be  keep  unchanged.  When  e  is  totally  within  a  sole  community  C,  handling  its 
removal  is  complicated  since  this  can  lead  to  an  unpredictable  transformation  of  the  host  module: 
C  could  either  be  unchanged  or  broken  into  smaller  modules  if  it  contains  substructures  which 
are  less  attractive  to  each  other,  as  depicted  in  Figure  9.  Therefore,  the  problem  of  identify  the 
structure  of  the  remaining  module  becomes  the  central  part  for  not  only  this  case  but  also  for  the 
others. 


Algorithm  7:  Removing  an  edge  ( u ,  v) 


Input  :  The  current  structure  Ct-\. 

Output:  An  updated  community  structure  Ct. 

1  if  (u,  v)  is  an  isolated  edge  then 

2  |  Ct  =  (Ct_i\{-u,  v})  U  {«}  U  {n}; 

3  end 

4  else  if  du  =  1  (or  dv  =  1)  then 

5  |  C^^AC^UMUCW; 

6  end 

7  else  if  C  =  C(u )  D  C(v)  =  0  then 

8  Ct  =  Ct- 1; 

9  end 

10  else  if  \D((7\(w,  v))  <  r(C\(u,v ))  then 

n  /*Here  C  ^  0*/; 

12  LC  •*—  Local  communities  by  Alg  1  on  C\(u ,  v); 

13  Define  each  L  €  LC  a  local  community  of  Ct-i, 

14  Merging  overlapping  community  on  L’s; 

is  end 

16  Update  Ct\ 


To  quickly  handle  these  tasks,  we  first  verify  the  inner  density  of  the  remaining  module  and,  again 
utilize  the  local  community  location  method  (Alg.  1)  to  locally  identify  the  leftover  substruc¬ 
tures.  Next,  we  check  for  community  combination  since  these  structures  can  possibly  overlap  with 


(a] 


(b) 


Figure  9:  (a)  The  original  community  (b)  When  the  dotted  edge  is  removed,  the  community  is 
broken  into  two  overlapped  communities 

existing  network  communities.  The  detailed  procedure  is  described  in  Alg.  7. 


4  Assessing  Network  Structure  Vulnerability 


Impact  of  Nodes’  Failures  on  Network  Components.  In  this  task,  we  are  interested  in  identi¬ 
fying  the  set  of  nodes  whose  removal  triggers  a  significant  restruction  of  the  current  community 
structure.  In  term  of  notations,  given  the  input  network,  the  community  detection  algorithm  A 
and  a  positive  number  k,  we  formulated  the  Community  structure  Vulnerability  Assessment  (CVA) 
which  aims  to  find  a  set  S  of  k  nodes  whose  removal  maximally  transforms  the  current  network 
community  structure  to  a  totally  different  one,  evaluated  via  the  Normalized  Mutual  Information 
measure. 

Definition  1  Given  a  network  represented  by  an  undirected  and  unweighted  graph  G,  a  specific 
community  detection  algorithm  A,  and  a  positive  integer  k  <  N,  we  seek  for  a  subset  SC.  V  such 

that  S  =  argmin  {NMIX(S')},  where  X  =  A(G),  and  NMIX{S')  =  NMI(X,  A(G[V\S'])) 
S'CV,\S'\=k 
for  any  S'  C  V. 

Our  major  findings  of  this  tasks  are:  (1)  We  analyzed  conditions  that  can  possibly  lead  to  the 
minimization  of  NMI  on  community  structures.  (2)  We  devised  an  approximation  algorithm  for 
the  case  k  —  1,  and  suggested  multiple  heuristic  algorithms  for  CVA  problem.  We  validated  the 
effectiveness  of  our  solutions  on  both  synthesized  data  with  known  community  structures  and  real- 
world  traces  including  Arxiv  citation  network,  Facebook,  and  Foursquare  social  networks.  The 
details  can  be  found  in  Alim  et  al.  (WI)  and  Nguyen  et  al.  (ASONAM). 

We  have  provided  the  basic  results  for  the  NMI  analysis  as  follows: 

Lemma  5  There  is  a  graph  G  =  (V,  E)  in  which  NMIxi)  is  not  a  submodular  function.  More¬ 
over,  there  are  subsets  L  C  T  C  V  such  that  NMIxiT )  >  NMIx(L)  ( where  L,T  are  sets  of 
removed  nodes). 

Theorem  9  Given  two  community  assignments  A  C  If  there  is  s  f  A,  B  such  that  NM I x{A  + 
x)  -  NMIX  (A)  <  NMIX ( B  +  s )  -  NMIX  (B). 


We  provided  three  algorithms  to  find  a  subset  S.  Our  first  heuristic  algorithm  is  oriented  based 
on  the  modularity  contributions  of  network  communities  in  G.  There  are  two  versions  in  general, 
called  greedy  Mn  and  greedy  Me,  for  this  heuristic  approach  with  different  priorities  given  to 
nodes  and  communities.  In  greedy M n,  all  nodes  u’s  in  the  network  are  ranked  based  on  their 
modularity  contributions  qUtc  s,  and  the  top  k  nodes  are  selected  in  the  solution  set.  The  second 
algorithms,  greedyMc,  consists  of  two  steps:  it  first  finds  the  community  C  having  the  most 
modularity  contribution  qc,  and  then  selects  a  node  u  that  has  the  highest  modularity  portion  qUjC 
in  C  until  k  nodes  are  included  in  the  solution  set. 

Our  second  heuristic  approach  genEdge  for  CVA  problem  is  based  on  the  component.  Basically, 
given  a  community  structure  X  and  the  algorithm  A,  genEdge  tries  to  find  nodes  which  can  poten¬ 
tially  break  current  communities  into  smaller  ones  of  the  relatively  same  size,  where  the  preference 
given  to  large-size  communities.  In  particular,  genEdge  looks  into  communities  X,’s  of  X,  or¬ 
dered  by  their  sizes,  and  selects  nodes  that  can  divide  this  community  into  more  subcomponents. 

For  any  nodes  u,  v  G  C,  if  edge  (u,  v )  is  not  in  E,  we  call  it  a  missing  edge  in  C.  In  addition,  we 
call  an  edge  in  C  “negative”  if  it  is  incident  to  a  missing  edge  in  C,  and  “positive”  otherwise.  We 
define  the  concept  of  generating  edges  of  C  as  follows. 

Definition  2  (Generating  edge)  For  any  edge  (■ u ,  v )  in  C,  ifC  —  (On  N(u)  D  N(v))  U  {//,  i;}  and 
'T(C')  >  t(C),  we  call  (u.  v)  a  generating  edge  of  C.  We  further  call  C  a  local  core  generated  by 
(■ u ,  v)  and  write  gen(u ,  v)  =  C. 

For  any  community  C  of  G,  a  set  L  C  E  is  called  a  “generating  edge  set”  of  a  C  if  U (u,v)eLgen(u,  v ) 
C.  Since  C  can  be  generated  by  different  generating  edge  sets  and  we  are  constrained  on  the  node 
budget,  we  would  intuitively  seek  for  the  generating  edge  set  of  minimal  cardinality. 


Definition  3  (The  Minimum  Generating  Edge  Set )  Given  a  community  C  ofG,  the  MGES  problem 
seeks  for  a  generating  edge  set  L*  ofG  with  the  smallest  cardinality. 

The  cores  generated  by  edges  in  a  MGES  of  a  community  C  of  G  are  tightly  connected  and  they 
all  together  compose  C.  As  a  result,  if  we  delete  an  endpoint  of  every  edge  in  a  MGES,  C  will 
be  broken  into  smaller  modules  with  the  number  of  modules  is  at  least  the  number  of  edges  in  a 
MGES  (Lemma  6).  Since  our  goal  is  to  break  the  current  community  structure  X  into  as  many 
new  communities  as  possible,  the  removal  of  crucial  nodes  defined  by  edges  in  a  MGES  will  be  a 
good  heuristic  for  this  purpose.  But  first  and  foremost,  we  need  to  characterize  all  MGESs  in  the 
current  community  structure  X  based  only  on  the  input  network  G.  Lemma  7  realizes  the  location 
of  the  generating  edge(s)  of  a  local  core  in  a  community  C :  they  have  to  be  adjacent  to  nodes  with 
the  highest  degree  in  C.  Based  on  this  result,  we  present  in  Alg.  8  a  procedure  that  can  correctly 
find  the  MGES  of  a  given  community  C  (Theorem  10). 


Lemma  6  Let  L*  be  a  MGES  of  a  community  C.  The  removed  of  an  endpoint  in  every  edge  of  L* 
will  break  C  into  at  least  L*  subcommunities. 


Algorithm  8:  An  optimal  algorithm  for  finding  the  MGES 
Input  :  Network  G  =  (  V.  E )  and  a  community  C  e  X; 

Output:  Minimum  generating  edge  set  L*  of  C; 

1  Mark  all  nodes  as  “unassigned”  and  L*  =  0; 

2  Remove  all  negative  edges  in  C.  If  any  edge(s)  survives,  they  are  candidate  for  generating 
edges  in  their  corresponding  communities,  include  them  to  L* ,  go  to  step  3.  Else,  go  to  step 
4; 

3  Reconstruct  local  cores  based  on  generating  edges  found  in  step  2.  Mark  all  nodes  in  those 
communities  as  “assigned”.  Discard  generating  edges  in  L*  that  fall  into  any  newly 
constructed  communities.  Return  if  all  edges  are  assigned; 

4  Find  the  set  U  as  in  Lemma  7.  Find  the  edge  in  NE(U)  that  can  generate  a  local  community 
having  the  largest  size.  Include  this  edge  to  L*  and  mark  all  nodes  in  the  new  local 
community  as  “assigned”.  Ties  are  broken  randomly.  Return  if  all  edges  are  assigned; 

5  If  there  are  still  unassigned  nodes,  say  the  set  ICC,  construct  G'  =  G[(I  U  N(I))  D  C], 

Go  back  to  step  2; 


Lemma  7  Let  C  be  a  subset  ofV,  U  —  {u  e  C\d^  is  maximum  in  C}  and  NE(U )  =  { (u.  v)  u  e 
U  or  v  G  U  but  not  both  }.  Then,  \NE{U )  D  L*\  >  1. 


Algorithm  9:  genEdge  -  A  node  selection  strategy  for  CVA  based  on  generating  edges 
Input  :  Network  G  =  ( V ,  E),  X  =  A(G)\ 

Output:  A  set  S'  C  1/  of  A;  nodes; 

1  Use  Alg.  8  to  find  L*x,  for  all  communities  2Q’s  in  X ; 

2  Sort  all  communities  2Q’s  in  X  by  their  sizes  of  MGESs; 

3  Sort  all  nodes  in  G  by  the  number  of  generating  edges  that  they  are  incident  to  in  X, .  If 
there  is  a  tie,  sort  them  by  their  degrees  in  G; 

4  Return  top  k  nodes  from  step  3; 


Theorem  10  Let  dc  be  the  maximum  in-degree  of  a  node  in  C.  Alg.  8  takes  0(dc\C\)  time  in  the 
worst  case  scenario  and  returns  an  optimal  solution  for  MGES  problem. 


Impact  of  Edges’  Failures  on  Network  Components.  In  this  task,  we  are  interested  in  identify¬ 
ing  the  set  of  edges  whose  removal  triggers  a  significant  reconstruction  of  the  current  community 
structure,  defined  as  follows: 


Definition  4  (DBC)  Given  an  undirected  graph  G  =  (V,  E),  and  a  set  X  of  k  communities,  find  a 
subset  S  C  E  of  minimum  cardinality  such  that  removing  S  from  the  graph  breaks  every  commu¬ 
nity  in  So. 


Our  major  findings  of  this  task  are: 


•  We  defined  the  framework  for  community  structure  fragility.  At  first  we  introduced  the  density 
based  broken  community  (DBC)  problem  for  breaking  k  communities  with  the  minimum  num¬ 
ber  of  edge  removals  and  provided  an  approximation  algorithm,  namely  CVA,  with  theoretical 
performance  guarantee,  0(log  k).  Its  pseudo-code  is  shown  in  Algorithm  10. 

•  To  analyze  the  vulnerability  of  the  community  structures  in  a  broader  sense,  we  extended  the 
problem  formulation  to  communities  produced  from  an  arbitrary  community  detection  algo¬ 
rithm.  We  offered  an  efficient  heuristic  to  break  the  communities  and  identify  the  set  of  critical 
edges. 

•  We  conducted  extensive  experiments  with  different  parameters  to  mine  interesting  observations 
about  the  behavior  of  broken  communities  after  edge  removal. 


Algorithm  10:  CVA:  An  approximation  algorithm  for  finding  the  critical  edges 
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Data:  Network  G  =  ( V ,  E),  DeletionVector  D,  |^| 
Result:  A  set  S  C  E  edges 
S' 0; 

C  •<—  0; 

for  each  edge  e  G  E  do 
compute  the  gain  /(e); 

end 

while  \C\  <  k  do 

e'  argmax{/(e)}; 

e£E 

In  case  of  a  tie,  choose  randomly; 

S  ■<—  S  U  {e'}; 
for  /  =  1  to  k  do 

if  Ci  ^  C  then 
if  e'  G  Ci  then 

Di  <—  Di  —  1; 
if  I)i  <  0  then 

C<-CU{C,}; 

/(e)  =  /(e)  -  1  for  all  e  e  Ct\ 
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j  end 
end 

end 

end 

end 

return  S; 


k 


The  details  can  be  found  in  Alim  et  al.  (ASONAM). 

For  general  definition  of  community  structure,  we  extended  the  DBC  problem  to  the  following 


one: 


Definition  5  (Broken  Community )  Consider  a  community  detection  algorithm  srf ,  which  produces 
a  collection  cto  of  communities  on  graph  G  ( written  cto  =  -f/ (G) ).  Let  G'  be  a  new  graph  after 
removal  of  a  set  of  edges,  and  let  cto'  —  srf  (Gr).  Let  7  G  (0, 1).  A  community  C  6  is  said  to  be 
broken  in  graph  G'  if  there  does  not  exist  a  community  C'  e  cto'  satisfying 
(i)  C'  C  C,  and  (ii)  |C"|/|C'|  >  7 


We  have  shown  that  partitioning  a  community  C  into  at  least  c  e-balanced  subparts,  where  7 c  > 
1  +  e  makes  it  broken.  Therefore,  we  developed  the  following  Algorithm  1 1 . 


Algorithm  11:  CCF:  A  heuristic  algorithm  for  breaking  communities 
Data:  Network  G  =  (V,  E),  k  Communities  strictness  threshold  7 
Result:  A  set  S  C  E  of  edges 

1  S  <—  f; 

2  c  <—  z  :  z  is  the  smallest  integer  satisfying  zy  >  1  +  e; 

3  for  each  community  C,  e  do 

4  compute  the  c-way  balanced  partitioning; 

5  Cuti  =  set  of  edges  to  cut  Ct  into  c  parts; 

6  S  <—  S  u  Cuf ; 

7  end 

8  return  S; 


5  Evacuation  Modeling 


The  research  summarized  here  is  from  a  current  submission  by  Vogiatzis  and  Pardalos  to  the  Eu¬ 
ropean  Journal  of  Computational  Optimization.  Disaster  management  and  evacuation  planning 
are  both  of  utmost  importance  for  the  societal  welfare  of  modem  countries  and  states.  On  top  of 
its  humanitarian  benefits,  proactive  planning  of  a  response  to  a  natural  or  man-made  disaster  also 
holds  significant  cost  savings. 

Most  approaches  tackling  the  evacuation  planning  problem  can  be  categorized  based  on  their  un¬ 
derlying  methods.  Typically,  problems  of  the  sort  are  formulated  and  tackled  as  large-scale  linear 
programming  problems,  with  approaches  that  generalize  network  flow  algorithms.  The  problem 
with  such  methods  stems  from  the  large-scale  nature  of  the  problem,  which  does  not  enable  us 
to  solve  real-life  scenarios.  A  second  approach  utilizes  simulation  and  agent-based  methods  to 
stochastically  imitate  the  behaviors  of  drivers  and  unexpected  delays/failures  in  the  infrastructure. 
Once  more,  due  to  the  large-scale  nature  of  the  problem,  these  methods  are  very  computationally 
expensive,  especially  with  the  addition  of  more  realistic  constraints.  Last,  but  not  least,  there  exist 
many  approaches  in  literature  that  fall  within  the  general  spectrum  of  heuristics,  which  try  to  take 
advantage  of  specific  characteristics  of  the  evacuation  process. 


In  this  work  we  also  consider  centrality  indices  within  a  transportation  network.  While  centrality 
is  not  a  novel  idea  (as  it  has  been  around  since  the  early  1950s),  to  the  best  of  our  knowledge  it  has 


not  been  applied  on  the  evacuation  modeling  field.  Node  centrality  represents  the  importance,  or 
“criticality”,  of  a  given  node  in  the  grand  scheme  of  the  network,  and  is  considered  fundamental  in 
network  analysis. 

Consider  a  simple,  directed  graph  G(V,E),  with  \V\  =  n  vertices,  and  \E\  =  m  edges.  Two 
vertices  i  and  j  are  said  to  be  connected  if  there  exists  a  path  of  vertices  beginning  at  i  and  ending 
in  j,  i.e.  {n0, . . . ,  Vk}  where  v0  =  i  and  /'/,  =  /,  and  for  every  two  consecutive  vertices  Vi,  vi+ 1  in 
the  path,  we  have  that  (vi,  vi+ 1)  E  E.  A  graph  G  is  connected  if  any  pair  of  nodes  i,  j  E  V  are 
connected:  it  is  a  common  assumption  that  transportation  networks  are  always  connected.  Hence, 
we  also  make  this  assumption  for  simplicity. 

As  we  are  considering  a  time  expanded  network,  we  deal  with  an  instance  of  the  graph  G  at  any 
given  time  t  E  T,  where  |T|  is  assumed  to  be  a  big  enough  horizon  to  cover  our  evacuation 
operations.  Hence,  we  have  a  graph  G^\  with  its  node  set,  V^\  and  edge  set,  E^\  Every  edge 
is  also  associated  with  a  parameter  mt]  that  represents  the  amount  of  time  it  would  take  a  vehicle 
to  traverse  it.  In  transportation  networks,  this  can  be  represented  more  accurately  with  a  random 
variable  and/or  a  dependence  on  the  flow  currently  using  the  street;  however,  for  our  purposes 
of  network  decomposition  for  evacuation  problems,  it  was  deemed  unnecessary  and  as  such  it  is 
treated  as  a  parameter.  A  subset  of  nodes  S  C  V  is  described  as  safe,  and  is  the  destination  of 
any  vehicle  in  the  transportation  network  during  the  evacuation  process.  We  further  assume  that 
vehicles  do  not  have  a  preference  on  the  node  i  E  S  they  would  like  to  arrive  in. 

Moreover,  we  consider  that  certain  information  is  readily  available  on  the  sets  of  vertices  and  edges, 
before  modeling  and  solving  the  evacuation  problem  begins.  Namely,  each  edge  (i,j)  E  E^  has 
a  capacity  on  the  number  of  vehicles  it  can  accommodate  at  any  time  t  E  T,  symbolized  by  ufj  . 
For  simplicity,  it  can  be  generally  assumed  that  ufj  =  V/  E  T.  The  capacity  is  extended  to 
nodes  as  well,  as  we  assume  that  a  node  i  E  V  is  associated  with  an  upper  bound  on  the  number 
of  vehicles  that  can  be  there  at  a  given  time  t,  cf\  Nodes  also  have  an  initial,  known  demand,  d\°\ 
Last,  we  assume  that  information  on  the  level  of  danger  the  node  is  under  at  any  given  time  t  E  T. 
This  can  be  provided  to  us  by  simulation  of  the  underlying  disaster.  In  order  to  help  us  with  our 
mathematical  formulation,  we  assume  =  0  for  all  i  E  S;  the  remaining  nodes  i  E  V  \  S  take  a 
value  l!f]  >  0,  with  larger  values  signaling  the  necessity  for  immediate  evacuation. 

For  betweenness  centrality,  we  use  the  definition  typically  encountered  in  literature,  which  is 
shown  in  (23)  for  a  node  k  E  V,  and  in  (24)  for  a  set  of  nodes  N  C  V. 


c(k)=  e  E  —  <23> 

iev\{k}  jev\{k}-.i^j  9lJ 

c(n)  —  y,  E  (24) 

iev\N  jev\N-.i^j  9l] 


In  the  above  expressions,  gijik)  is  the  number  of  geodesic  (shortest)  paths  connecting  nodes  i  and 
j  that  pass  through  k,  whereas  gij(N)  the  same  for  group  of  nodes  N.  The  denominator  in  both 


cases  is  the  total  number  of  geodesic  paths  connecting  nodes  i  and  j,  which  can  be  bigger  than  1  in 
the  case  of  multiple  alternate  shortest  paths.  Observe  that  the  group  betweenness  of  a  set  N  cannot 
be  calculated  by  adding  the  individual  node  betweenness  of  each  node  members. 

Let  xfj  denote  the  number  of  vehicles  traversing  edge  (i,  j)  G  E(t>  at  time  t.  For  every  node  i  G  V, 

let  df  represent  the  number  of  vehicles  waiting  there  at  time  t.  Notice  that  the  demands  for  the 
nodes  at  each  time  t  >  0  are  treated  as  variables,  which  enables  us  to  instruct  vehicles  to  wait  at 
their  position  instead  of  moving,  whenever  the  decision  to  move  them  would  hinder  the  success  of 
the  evacuation  plan.  For  t  —  0,  df  is  treated  as  an  input  parameter.  Further,  we  introduce  binary 
variable  yVJ  as  follows: 


_  J  1,  if  edge  (i,  j)  is  reversed  during  the  evacuation  process, 
y'J  (  0,  otherwise. 

From  the  definition  of  the  set  of  y  variables,  it  is  clear  that  we  consider  only  the  case  that  a  street 
can  be  declared  reversed  (along  with  the  necessary  policing  and  precautions)  from  the  beginning 
of  the  evacuation  process  and  cannot  change  back  to  its  original  sense  until  the  end  of  operations. 
Last,  we  assume  we  are  given  a  horizon  of  periods  T  =  (1,2,...,  |Tj},  during  which  time  a 
maximum  number  of  vehicles  is  to  reach  a  safe  node.  Equivalently,  the  number  of  vehicles  still 
evacuating  can  be  minimized.  The  mathematical  formulation  can  now  be  presented  in  (17)-(34). 


/W  , 

EEW  +  E  E  2  E 

(25) 

teT  iev  teT  (ij)gfi(t) 

s.t.  xf  <  (1  -  VijjUij  +  yjiUji, 

V(i,  j)  G  E{t\Vt  e  T 

(26) 

Vij  V"  '!-jji  V  1) 

V(iJ)£E 

(27) 

if  <  Ci, 

Vi  G  V{t\\/t  G  T\  {0} 

(28) 

df+1)=E-  y  41+  v  4r«\ 

Vi  G  V(t\yt  G  T 

(29) 

t—rriij  >0 

y4  -  k > 

VteT 

(30) 

(i,j)eE 

xfj  =  o, 

Vi,  j  G  l/(t)  :  lf]  <  if 

(31) 
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o 

V(i,j)  G  E^,Wt  G  T 

(32) 

o' 
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■w 

Vi  G  V{t)yt  G  T 

(33) 

yn  e  {0,  l}, 

V(i,  j)  G  E. 

(34) 

The  objective  function  in  (25)  aims  to  minimize  the  number  of  people  waiting  to  be  evacuated  in 
the  transportation  network,  either  waiting  in  one  of  the  nodes  i  G  V  or  using  an  edge  (i,j)  G  E. 
Observe  that  we  employ  the  simulation-obtained  danger  factors  if  to  derive  a  weighted  sum  of 


the  number  of  demands  that  remain  to  be  evacuated;  for  the  edges  we  use  an  average  estimate  of 
the  two  endpoints  at  that  specific  time  t  £  T.  That  way,  evacuees  that  are  further  away  would  take 
priority  in  our  operations,  as  they  increase  the  value  of  the  objective  function  significantly. 

Constraints  (26)  ensure  that  whenever  we  have  contraflow  present  in  a  segment  of  the  evacuation 
plan,  the  number  of  evacuees  using  the  street  can  increase  over  its  original  capacity,  as  the  capacity 
of  the  reverse  direction  can  be  employed.  Keep  note  that  this  is  not  necessarily  double  the  capac¬ 
ity  of  the  original  street,  as  there  exist  streets  where  the  capacities  are  asymmetric  per  direction. 
Moreover,  when  a  street  is  reversed,  then  the  constraint  ensures  that  no  flow  can  be  sent  employing 
that  same  street.  Constraint  (27)  guarantees  that  in  an  evacuation  setting,  at  most  one  of  the  senses 
of  any  street  can  be  reversed  at  a  time.  Continuing  with  the  constraints  of  the  problem,  in  (28) 
we  enforce  a  capacity  at  every  intersection  of  the  transportation  network.  That  way,  we  can  avoid 
having  evacuees  accumulate  at  any  intersection,  leading  to  street  capacity  losses.  It  can  be  assumed 
that  the  capacity  of  the  safety  nodes  is  much  higher  than  the  capacity  of  the  rest  of  the  nodes  in  the 
network. 

Constraints  (29)  are  the  classical  flow  preservation  constraints,  adapted  for  the  time-dynamic  net¬ 
work.  They  enforce  that  the  number  of  evacuees  waiting  at  an  intersection  i  at  a  time  t  are  as  many 
as  there  were  in  the  previous  time  step  t  —  1  when  considering  also  the  number  of  vehicles  that 
are  incoming  and  subtracting  the  ones  outgoing.  As  a  reminder,  we  have  assume  that  each  actual 
street  of  the  network  has  been  assigned  a  parameter  rntj  that  stays  constant  throughout  the  process 
which  represents  the  (integer)  number  of  periods  it  takes  to  traverse  it.  Of  course,  we  also  need  to 
add  a  budget  constraint,  as  it  is  impossible  to  enable  the  reversal  of  every  street  in  our  evacuation 
plan.  The  budget  constraint  is  shown  in  (30). 

Furthermore,  we  have  constraints  (31)  that  do  not  allow  a  vehicle  to  move  from  a  less  dangerous 
to  a  more  dangerous  area.  This  constraint  apart  from  enabling  us  with  the  islanding  scheme  to  be 
discussed  in  the  following  subsection,  also  guarantees  that  the  objective  function  is  non-increasing 
from  time  step  to  time  step.  Finally,  we  guarantee  nonnegativity  of  all  variables  and  the  binary 
nature  of  the  y  variables  in  (32)-(34). 


Simple  Islanding.  The  above  problem  is  indeed  very  hard  to  solve  in  real-life,  large-scale  in¬ 
stances.  As  an  example,  it  would  take  a  commercial  solver  multiple  hours  to  obtain  an  optimal 
solution,  when  in  fact  in  many  situations,  it  is  imperative  that  an  evacuation  plan  is  devised  and 
implemented  much  faster  than  that. 

To  tackle  this  issue,  we  propose  a  decomposition  approach  that  produces  a  series  of  connected 
clusters,  called  “islands”.  For  the  decomposition,  we  assume  that  the  number  of  clusters  \N\  is 
given  as  an  input.  An  initial  decomposition  approach  is  presented  in  Algorithm  12.  For  this 
algorithm,  it  is  necessary  that  we  know  the  distance  a  vehicle  needs  to  traverse  from  every  node 
i  G  V\S  to  arrive  at  a  node  j  <G  S  belonging  to  the  safe  zone,  without  crossing  an  edge  (i,j)  e  E® 
such  that  /f  <  Let  this  function  be  referred  to  as  ModifiedDijkstra(i ,  S ),  for  a  given 

node  i  e  V  and  the  set  of  safe  nodes  in  the  network,  S. 


The  modification  to  the  original  approach  to  finding  all  shortest  paths  from  a  node  to  a  set  of  nodes 


is  pretty  straightforward.  We  perform  a  preprocessing  of  the  networks  G®  where  we  remove  all 
edges  satisfying  lf^  <  ]^+rn‘:‘  ) ;  we  then  proceed  to  calculate  the  shortest  path  from  each  node  to  a 
virtual  aggregate  node  connected  to  all  safe  nodes  with  0  traversal  time.  Last,  we  assume  we  are 
given  ti,  f2,  •  •  •  t\N\  as  threshold  distances  for  a  node  to  belong  to  cluster  1,2,...,  |iV|,  respectively. 


Algorithm  12:  Decomposition  algorithm  based  on  distance  from  safety  and  danger  factor 

1  n  G-  \N\; 

2  for  each  node  i  G  V  C  S  do 

3  dist[i)  G- modifiedDijkstra(i,S ); 

4  for  k  G  {1,2,...,  n}  do 

5  if  dist(i )  <  tk  then 

6  |  Nk  Nk  U  {i} 

7  end 

8  end 

9  end 


Betweenness  Islanding.  An  extension  of  Algorithm  12  is  presented  in  Algorithm  13.  This  one 
takes  into  consideration  the  betweenness  centrality  of  a  cluster  C  and  aims  to  decompose  the 
central  hubs  in  several,  distinct  clusters.  A  simple  description  of  Algorithm  13  can  be  the  following. 
We  first  calculate  the  betweenness  of  every  node  in  the  graph,  considering  though  only  the  shortest 
paths  from  every  node  i  G  V  \  S  to  every  safe  node  s  G  S  (let  this  procedure  be  referred  to  as 
SafeBetweenness(i )  for  a  node  i  G  V  and  SafeBetweenness(C )  for  a  set  of  connected  nodes 
C  C  V ).  We  then  calculate  the  group  betweenness  of  all  connected  clusters  N  of  size  n,  using 
only  the  shortest  paths  to  safety.  Note  that  in  regular  betweenness  calculations,  the  shortest  paths 
between  every  pair  of  nodes  (i,j)  in  the  network  are  considered;  instead,  here  we  only  consider 
the  shortest  paths  between  any  node  i  G  V  \S  and  any  safe  zone  s  G  S.  The  set  of  size  n  with  the 
biggest  betweenness  centrality  is  selected  and  its  nodes  are  now  to  be  divided  among  the  different 
clusters  of  the  islanding  scheme.  One  way  for  this  to  be  achieved,  is  to  find  the  shortest  path  of 
every  other  node  in  the  network  to  the  ones  found:  then  each  node  can  be  greedily  assigned  to  the 
one  that  it  can  reach  the  fastest. 

The  first  algorithm  is  much  faster  due  to  the  fact  that  it  relies  on  simple  shortest  path  finding. 
However,  the  second  algorithm  too  is  tractable  for  small  values  of  n,  as  only  (^J)  possible  set 
nodes  are  to  be  considered. 

Experiments  can  be  found  in  the  Vogiatzis  and  Pardalos  submission.  They  were  performed  on 
synthetic  networks  of  varying  size  (100  to  10,000  nodes)  and  real-life  transportation  network  in¬ 
stances,  where  10%  of  the  nodes  are  selected  to  be  safe  zones.  Specifically  experiments  focus 
the  city  of  Jacksonville,  Florida,  which  presents  a  real  challenge  as  it  is  represented  by  a  huge 
transportation  network.  In  the  Jacksonville  network,  the  safe  zones  are  pre-selected  and  known, 
and  simulated  storms  are  obtained  through  the  CSEVA  package.  Figures  depicting  the  algorithms’ 
performances  on  the  Jacksonville  network  are  given  in  Figure  10  and  Figure  11. 


Algorithm  13:  Decomposition  algorithm  based  on  betweenness 
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14 
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max  <—  0; 

N0  <—  0; 

for  each  set  of  nodes  N  C  V  do 

if  isConnected(N)  &&  |iV|  =  n  then 
btn  =  SafeBetweenness(N); 
if  max  <  btn  then 
max  <—  btn; 

N0^N; 

end 

end 

end 

for  each  node  i  G  V  \  N0  do 
k  =  argmin{dik  :  k  €  N0}; 

Nk  <—  Nk  U  {i}; 

end 


Figure  10:  An  example  of  how  the  first  islanding  scheme  (Algorithm  12)  works  for  the  city  of 
Jacksonville,  FL. 

6  Multidimensional  Assignment  Problem 


This  research  is  published  in  the  European  Journal  of  Operational  Research  (see  Walteros  et  al. 
(2014)).  The  multidimensional  assignment  problem  (MAP)  aims  to  minimize  the  overall  cost  of 
assignment  when  matching  elements  from  JV  =  {Ax, . . . ,  Nn}  (n  >  2)  disjoint  sets  of  equal 
size  m.  It  comes  as  a  natural  generalization  of  the  two-dimensional  Assignment  Problem  (AP), 
known  to  be  polynomially  solvable.  Among  all  the  different  generalizations  of  the  MAP,  the  one 
considered  in  this  study  is  the  axial  MAP  (hereafter  referred  to  as  MAP).  In  an  axial  MAP,  each 
element  of  every  set  must  be  assigned  to  exactly  one  of  m  disjoint  //  -tuples,  and  each  n-tuple  must 


Figure  11:  An  example  of  how  the  first  islanding  scheme  (Algorithm  13)  works  for  the  city  of 
Jacksonville,  FL. 


contain  exactly  one  element  of  each  set.  Contrary  to  the  AP,  the  MAP  is  known  to  be  NP-hard  for 

n  >  2. 


The  MAP  can  be  modeled  as  the  following  integer  (0-1)  program 
{MAP)  :  min 

iieJVi  i2=N2  in€Nn 

EE-E 


xi\i2...in 


12&N2  i3£N3  in&Nn 


E  •••  E  .  E  E 

il£Nl  !g_l6JVs_l  *s  +  lGtVs  +  1  in&Nn 


%ili2...in  1; 


xhi2-in  i) 

ilGiVi  i2£N2  in-i£Nn~i 


(35) 

h  e  iVi 

(36) 

G  A" g ,  5  2, . . . ,  n  1 

(37) 

^  An 

(38) 

i.5  G  As,  s  =  1 . . .  n, 

(39) 


where,  for  every  n-tuple  (A  i2, . . . ,  i„)  G  Ai  x  A2  x  •  •  •  x  An,  variable  xili2___in  takes  the  value  of 
one  if  elements  of  the  given  n-tuple  belong  to  the  same  assignment,  and  zero  otherwise.  The  total 
assignment  cost  (35)  is  computed  as  the  cost  of  matching  elements  from  different  sets  together.  As 
an  example,  an  assignment  which  selects  elements  . . .  ,in)  to  be  grouped  together  would 

have  a  cost  of  cili2...in. 

Depending  on  the  definition  of  the  assignment  costs,  there  are  several  variations  of  the  MAP  that 
can  be  considered.  These  variations  are  mainly  associated  with  cases  where  the  assignment  cost  of 
each  n-tuple  can  be  decomposed  as  a  function  of  all  possible  pairwise  assignment  costs  between 


elements  of  different  sets.  That  is,  cili2___in  =  f{cili2% . . . ,  cinin_  J,  where  /  :  Ni  x  N2  U  •  •  •  U 
iVn_ i  xiVn^M  and  is  the  cost  of  assigning  together  elements  is  e  iVs  and  it  G  Nt,  for  s  ^  t. 
In  general,  the  main  advantage  of  having  decomposable  cost  functions  is  that  there  may  be  ways  of 
tackling  the  problem  without  having  to  completely  enumerate  all  of  the  different  assignment  costs, 
which  can  be  exponentially  many.  Moreover,  most  of  these  MAP  variations  can  be  associated 
with  a  weighted  n-partite  graph,  in  which  the  elements  are  represented  by  the  vertices  of  the  graph, 
each  of  the  edges  describes  the  decision  of  assigning  two  elements  within  the  same  n-tuple,  and  the 
weights  on  the  edges  account  for  the  corresponding  assignment  costs.  In  particular,  we  consider 
the  case  where  each  n-tuple  of  any  feasible  assignment  is  assumed  to  form  a  star. 


For  the  case  of  the  stars,  one  element  of  each  tuple  is  assigned  to  be  a  center  (or  representative) 
and  the  other  elements  are  considered  to  be  the  leafs  (or  legs)  of  the  star.  Note  that,  contrary  to  the 
case  of  the  cliques,  each  tuple  can  generate  many  different  star  configurations,  depending  on  which 
element  is  selected  as  the  center.  Assuming  for  example,  that  the  center  is  element  is,  the  cost  of  the 
induced  star  is  the  sum  of  the  pairwise  costs  between  is  and  the  other  elements  of  the  tuple.  In  view 
of  these  multiple  possible  configurations,  the  cost  of  tuple  (ii,  i2,  ■  ■  ■  ,in)  €  iVi  x  N2  x  •  •  •  x  Nn 
is  defined  as  the  minimum  cost  among  the  costs  of  all  the  possible  star  configurations  of  the  tuple. 
That  is, 


nnn 

*sS{ii, *2, •••,*»]} 


E 


'"I's'l't 


(40) 


The  aforementioned  MAP  version  is  called  the  multidimensional  star  assignment  problem  (MSAP), 
because  of  the  particular  structure  that  each  feasible  assignment  has.  There  are  several  contexts  in 
which  using  star  costs  can  prove  beneficial  when  solving  multi-sensor  multi-target  tracking  prob¬ 
lems.  In  particular,  when  the  assignment  costs  have  metric  properties  (i.e,  nonnegativity,  symmetry, 
and  subadditivity),  it  is  interesting  to  see  that  in  some  cases,  considering  all  pairwise  costs  within 
the  assignments  (e.g.,  the  clique  case)  is  not  necessary  to  obtain  a  valid  solution.  We  provide  two 
examples  with  costs  that  satisfy  those  properties  and  show  that  the  star  cost  variation  is  a  valuable 
tool  to  solve  those  problems.  We  would  like  to  emphasize  though,  that  the  star  costs  are  not  always 
a  better  or  worse  option  compared  to  other  versions  such  as  the  clique  costs.  Instead,  it  can  be 
seen  as  an  alternative  that  also  provides  additional  information,  and  that  can  contribute  to  a  better 
analysis  depending  on  the  context. 

In  the  first  example  we  aim  to  identify  a  set  of  land  mines  that  are  planted  on  a  field.  To  find 
the  location  of  the  mines,  a  drone  is  sent  to  fly  over  the  field  emitting  a  signal.  Once  the  signal 
reaches  each  of  the  mines,  it  bounces  back  and  is  analyzed  by  the  sensors  of  the  drone.  After 
the  drone  has  flown  over  the  field  a  number  of  times  and  its  sensors  have  collected  the  set  of 
different  signals  (several  of  those  associated  with  each  of  the  mines),  it  is  possible  to  calculate  a 
set  of  estimated  locations  where  the  mines  could  be  located.  The  idea  behind  solving  a  MAP  is  to 
associate  the  locations  that  are  close  to  each  other,  which  would  help  pinpoint  the  actual  positions 
of  the  mines.  In  this  context,  the  assignment  costs  represent  the  Euclidean  distances  between  the 
estimated  locations  and,  since  the  costs  satisfy  the  triangle  inequality,  not  all  the  costs  need  to  be 
considered  to  obtain  a  valid  association. 

Moreover,  the  expected  position  of  the  mine  is  often  considered  to  be  a  concurrency  point  asso- 


o  ©  (& — ^ 


Figure  12:  A  valid  star  assignment  for  a  graph  with  n  —  4  and  m  —  3 


ciated  with  the  positions  that  are  in  the  same  n-tuple,  generally  the  centroid.  On  the  other  hand, 
if  star  costs  are  used,  the  region  around  the  center  of  the  stars  can  be  seen  as  the  zone  where  the 
mines  are  most  likely  to  be  located.  Under  the  triangle  inequality  assumption,  it  is  easy  to  prove 
that  many  of  the  triangle  concurrency  points  (e.g.,  the  centroid,  the  incenter,  or  the  circumcenter) 
are  always  closer  to  the  center  of  the  star. 

The  second  example  is  a  case  where  the  costs  do  not  represent  Euclidean  distances  and  hence, 
the  concept  of  the  geometric  center  does  not  have  a  proper  interpretation.  Assume  we  have  a 
group  of  antennas  that  are  placed  to  intercept  a  collection  of  encrypted  messages  that  we  want 
to  decode.  Because  of  the  interference  and  the  noise  of  the  environment,  when  the  messages  are 
received  by  the  antennas  they  are  somehow  disrupted  and  thus  not  perfect  for  decoding.  Each 
of  the  antennas  can  potentially  receive  a  different  version  of  each  of  the  messages.  The  idea  is 
to  identify  which  of  the  received  versions  are  the  ones  that  most  closely  resemble  the  correct 
(transmitted)  ones,  so  they  can  be  sent  for  decoding.  Here,  since  there  is  no  way  to  compare 
the  disrupted  versions  with  the  correct  messages,  the  decision  of  which  versions  are  finally  sent 
to  decode  should  be  made  by  analyzing  the  dissimilarities  between  the  received  messages.  In 
many  contexts  like  this,  the  decoding  process  could  be  rather  difficult.  Hence,  it  is  desired  to 
select  only  one  of  the  disrupted  versions  of  each  of  the  messages.  Assuming  that  the  messages 
are  encrypted  in  some  kind  of  alphabet  (e.g.,  binary  codes),  using  the  centroid  of  the  disrupted 
versions  is  not  a  valid  approach  here.  In  this  framework,  the  use  of  the  star  costs  could  be  of 
benefit,  because  the  messages  associated  with  the  centers  of  the  stars  can  be  the  ones  selected  for 
decoding  (representative).  For  this  problem,  the  costs  can  be  assumed  to  be  the  number  of  different 
characters  between  the  messages,  the  sum  of  how  far  apart  in  the  alphabet  the  different  characters 
of  the  messages  are,  or  any  desired  correlation  metric. 

Given  a  collection  N1: ... ,  Nn  of  n  disjoint  node  sets  of  equal  size  m  and  the  corresponding  col¬ 
lection  of  pairwise  arc  sets  E12, . . .  En_ ljn,  where  Est  —  Ns  x  Nt  for  s  <  t,  let  Q  —  (A/",  S)  be  a 
complete  n-partite  graph,  where  A f  =  [X=i  Ns  and  £  =  Us<t  Est.  We  refer  to  the  zth  node  of  set 
Ns  with  the  duple  (i,  s )  and  use  the  quadruple  (i,  s,  j,  t),  to  represent  the  edge  between  nodes  (i,  s ) 
and  (j,  t ).  Also,  let  cfj  be  a  cost  value  associated  with  edge  (i,  s,j,  t)  that  accounts  for  the  cost  of 
assigning  nodes  (i,  s)  and  (j.  t )  to  the  same  star.  Let  a  valid  star  be  defined  as  a  subgraph  of  Q  such 
that,  (1)  it  contains  exactly  one  node  from  each  set  A^, ... ,  Nn;  (2)  one  of  the  nodes  (the  center)  is 
connected  to  all  of  the  other  nodes  of  the  star  (the  leafs);  and  (3)  there  are  no  connections  between 
any  pair  of  leafs.  Then,  the  MSAP  aims  for  a  set  of  m  disjoint  valid  stars  that  cover  all  the  nodes 
in  Q.  An  example  of  a  valid  star  assignment  of  an  instance,  where  n  —  4  and  m  =  3  is  given  in 
Figure  12.  The  three  valid  stars  are  colored  gray,  black,  and  white. 


Continuous  nonlinear  formulation.  Let  variables  z  and  x  be  defined  as  follows: 


J  1,  if  node  (i,  s)  G  J\f  is  a  star  center 
|  0,  otherwise, 


and 


J  1,  if  nodes  (i,  s)  and  (j,  t)  G  AT  belong  to  the  same  star 
|  0,  otherwise. 


Observe  that  xfj  =  for  all  (i,  s,  j,  f),  and  xf*  =  0,  since  (i,  s,  j,  s)  ^  £.  The  initial  formulation  is 
presented  in  (41)-(48),  where  the  objective  function  (41)  aims  to  minimize  the  overall  assignment 
cost.  Constraints  (42)  ensure  that,  if  node  (i,  s)  is  a  center,  it  must  be  connected  to  (n  —  1)  nodes. 
Conversely,  if  it  is  not  a  center,  then  it  should  be  connected  to  one  node.  Constraints  (43)— (44) 
guarantee  that  if  node  (i,  s )  is  a  center,  it  must  be  connected  to  exactly  one  node  from  each  set  Nt, 
for  all  t  ^  s.  Further,  constraints  (45)  enforce  that  there  are  exactly  m  stars  in  the  optimal  solution. 
Nonlinear  constraints  (46)  guarantee  that  each  node  (i,  s)  G  JV  is  either  connected  to  a  center,  or 
is  a  center  itself,  and  hence,  it  can  only  be  connected  to  leafs.  Last,  (47)-(48)  define  the  domain  of 
variables  z  and  x. 
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Let  RNLP  be  the  continuous  relaxation  of  formulation  (41)— (48).  That  is,  both  z  and  x  are 
allowed  to  take  fractional  values  between  zero  and  one.  We  now  proceed  to  prove  that  in  any 
feasible  solution  of  RNLP,  all  z  variables  take  integer  values.  For  this  proof,  assume  we  have 
a  feasible  solution  (z,  x).  We  refer  to  node  (i,  s)  as  white  if  zf  =  0,  black  if  zf  =  1,  or  gray  if 

zt  G  (0, 1). 


Lemma  8  In  any  feasible  solution  ofRNLP,  a  white  node  can  only  be  connected  to  black  nodes. 


Lemma  9  In  any  feasible  solution  ofRNLP,  a  black  node  can  only  be  connected  to  white  nodes. 


Based  on  Lemmata  8  and  9,  we  can  deduce  that,  if  there  exist  gray  nodes,  then  they  are  only 
connected  to  other  gray  nodes. 


Lemma  10  If  there  exist  gray  nodes  in  a  feasible  solution,  then  the  number  of  those  is  a  multiple 
°f  n. 


Theorem  11  In  any  feasible  solution  of  the  RNLP,  all  z  variables  are  binary  (i.e.,  there  cannot 
exist  gray  nodes). 


Contrary  to  the  case  of  the  z  variables,  it  is  easy  to  see  that  there  can  be  feasible  solutions  where 
some  of  the  x  variables  are  fractional.  The  following  theorem  states  that  if  there  exists  an  optimal 
solution  where  the  x  are  fractional,  there  is  also  an  alternative  integral  solution. 


Theorem  12  If  RNLP  is  feasible,  then  there  always  exists  an  optimal  solution  ofRNLP,  where 
all  x  variables  take  integer  values. 


As  a  result  from  Theorems  11  and  12,  constraints  (47)  and  (48)  can  be  relaxed  in  I  NLP,  leav¬ 
ing  the  continuous  nonlinear  optimization  problem  RNLP,  henceforth  referred  to  only  as  NLP. 
To  solve  this  formulation  we  can  use  any  available  optimizer  that  handles  nonlinear  programs. 
Although,  in  spite  of  having  a  continuous  formulation,  rather  than  an  integer  one,  nonlinear  con¬ 
straints  (46)  still  pose  a  difficult  challenge  because  of  their  non-convex  nature.  As  an  alternative 
approach,  instead  of  solving  NLP,  we  propose  using  a  standard  linearization  technique  that  in¬ 
volves  introducing  additional  variables  to  replace  the  bilinear  terms  in  constraints  (46).  Further¬ 
more,  from  the  results  presented  in  Theorems  11  and  12,  we  derive  additional  valid  inequalities 
that  strengthen  the  proposed  linear  formulation.  A  description  of  the  linearization  and  the  valid 
inequalities  follows. 

The  bilinear  terms  of  constraints  (46)  represent  the  greatest  difficulty  of  the  NLP  formulation. 
Thus,  we  apply  a  standard  linearization  technique  by  replacing  those  terms  with  additional  vari¬ 
ables  (w).  Unfortunately,  by  relaxing  the  nonlinear  constraints,  we  lose  the  integrality  properties 
described  in  Theorems  11  and  12.  Hence,  the  resulting  formulation  is  a  mixed  integer  linear  pro¬ 
gram  ( MIP ).  On  top  of  that,  this  reformulation  comes  with  an  overhead  of  0(n2m 2)  variables 


and  constraints.  The  proposed  reformulation  follows: 


(M/P)  :  min  V  V  V  V  cgx"  (49) 

i= 1  j= 1  «s=l  {t=l,...,n:s<t} 

s.t.  (42)  -  (45)  (50) 


Wij  —  ZF 

Vi,j  =  1,... 

. ,  m  s,t 

=  !,-■ 

. .  ,n 

(51) 

<  < 

Vi,j  =  1,... 

. ,  m  s,t 

=  !,-■ 

■  ■ ,  n 

(52) 

“1j  >  -j  -  •'•/'-l- 

Vi,j  =  1,... 

. ,  m  s,t 

=  !,-■ 

■  ■ ,  n 

(53) 

m  n 

*? +££<  =  !■ 

Vi  =  1, . 

. . ,  m  s 

=  !,-■ 

■  ■ ,  n 

(54) 

j=i  t= i 

wfj  e  [0,1], 

Vi  =  1, . 

. . ,  m  s 

=  !,-■ 

■  ■ ,  n 

(55) 

xfj  e  [°,i], 

Vi  =  1, . 

. . ,  m  s 

=  !,-■ 

■  ■ ,  n 

(56) 

zf  e  (0,  l}, 

Vi  =  1, . 

. . ,  m  s  - 

=  1,  •  • 

•  ,n, 

(57) 

where  variable  wfj  represents  the  bilinear  term  x\ *Zj,  for  all  (i,  s,j,  t )  G  £,  and  constraints  (51)- 
(53)  are  the  linearization  inequalities.  Note  that,  contrary  to  the  case  of  the  x  variables,  wfj  = 
xfjZ*  ^  xfjZ'l  =  Wj f.  Thus,  both  variables  w-j  and  v.P  must  be  included.  Finally,  using  a  sim¬ 
ilar  argument  as  in  Theorem  12,  it  is  easy  to  see  that  in  the  above  formulation  we  can  relax  the 
integrality  constraints  of  variables  x  and  w. 


Valid  Inequalities.  In  this  subsection,  we  introduce  five  families  of  valid  inequalities  that  strengthen 
the  MIP  formulation.  Since  we  no  longer  have  the  nonlinear  set  of  constraints  (46),  it  is  possi¬ 
ble  (and  likely)  that  the  linear  relaxation  of  this  formulation  produces  fractional  solutions  (i.e., 
gray  nodes).  To  cope  with  this  issue,  we  can  use  the  results  from  Lemmata  8  and  9  to  define  the 
following  inequalities. 


Proposition  1  For  any  edge  (i,  s,  j,  t )  G  E,  the  inequality  xf-  <2  —  zf  —  z1-  is  valid. 


This  inequality  comes  from  the  fact  that  in  any  feasible  solution  of  the  MIP  there  are  no  connec¬ 
tions  between  black  nodes  (star  centers).  Clearly,  if  both  variables  zf  and  zf-  take  the  value  of  one, 
the  corresponding  variable  xfj  cannot  be  positive. 


Proposition  2  For  any  edge  (i,  s,  j,  t)  G  £,  the  inequality  xf-  <  zf  +  z*-  is  valid. 


Similarly  as  before  (cf.  Proposition  1),  in  any  feasible  solution  of  the  MIP  there  are  no  connec¬ 
tions  between  white  nodes  (leafs).  Thus,  if  both  variables  zf  and  zl-  are  zero,  the  corresponding 
variable  xf!j  must  also  be  zero.  If  the  foregoing  constraints  are  included  in  formulation  (49)-(57), 
it  is  possible  to  relax  constraints  (54),  and  therefore  remove  the  extra  w  variables.  The  resulting 
formulation,  referred  to  as  All  Pa,  not  only  has  less  variables  and  constraints  than  M/P,  but  also 
produces  a  better  dual  bound. 


(MI Pa)  :  min  VVV  v  44 

i=  1  j= 1  s=l  {t=l,...,n:s<t} 

s.t.  (42)  -  (45) 

xfj  <  Z?  +  z], 

<  <  2  -  -  4 
^  e  (0? 1}) 

<  e  {0,  i}, 


(58) 

(59) 
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•  •  ,n 

(60) 
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(61) 

Vi  =  1, . 

. . ,  m 
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=  1,- 

■  ■ ,  n 

(62) 

Vi  =  1, . 

. . ,  m 

s  - 

=  1,.. 

■  ,n. 

(63) 

Theorem  13  MI  Pa  is  a  valid  formulation  for  the  MSAP. 


We  now  describe  three  additional  families  of  valid  inequalities. 


Proposition  3  For  any  node  ( i,s )  G  A f,  the  inequality 

m  n 

zt  +  ^2  ^2  yp  —  (64) 

j= 1 1= i 


where  qf-  G  {x|*, 

We  refer  to  this  family  as  the  minimum  sum  inequalities.  Note  that,  for  each  node  (i,  s ),  the  number 
of  inequalities  of  this  family  is  0(2mn).  Thus,  we  propose  the  separation  procedure  presented  in 
Algorithm  14.  Given  a  fractional  solution  (z,  x),  for  each  node  (i,  s ),  we  search  for  the  inequality 
that  is  violated  the  most.  For  this  purpose,  for  each  (j,  t)  such  that  (i,  s,  j,  t )  G  S,  we  select  as  qfj  in 
(64)  the  variable  associated  with  the  minimum  value  between  z)  and  xfy  We  repeat  this  procedure 
for  all  (i,  s)  G  A f,  adding  all  violated  inequalities. 

For  the  last  two  families  of  valid  inequalities,  consider  the  fractional  solution  depicted  in  Figure  13. 
This  is  an  optimal  solution  of  the  linear  relaxation  of  MI  Pa.  First,  observe  the  4-cycle  formed  by 
nodes  (2, 1),  (1, 3),  (1, 4),  (2,  2).  Clearly,  in  a  feasible  integral  solution  the  number  of  arcs  within 
the  cycle  cannot  be  greater  than  two.  We  analyze  this  inequality  in  Proposition  4. 


Figure  13:  Example  of  a  fractional  solution  of  the  linear  relaxation  of  MI  Pa 


Algorithm  14:  minSumSeparat  ion(£7,  i,  s,  z,  x) 

1  sum  =  z?; 

2  cut  =  zf; 

3  for  (j,  t )  such  that  (i,  s,  j,  t)  &  £  do 

4  if  xj  <  xfj  then 

5  sum  -t—  sum  +  xj; 

6  cat  -t—  cut  +  xj; 

7  end 

8  else 

9  sum  sum  +  xf* ; 

10  cat  -t—  cat  +  xfp, 

n  end 

12  end 

13  if  sum  <  1  then 

14  |  return  cut  >  1 
is  end 

16  else 

17  |  return  null 
is  end 


Proposition  4  For  any  4-cycle  involving  nodes  (i,  s ),  (j,  t),  (. k ,  u),  and  (/,  v),  xfj  +  +  x^  + 

x\i  <  2  /.s'  a  valid  inequality. 

We  refer  to  this  family  as  the  4-cycle  inequalities.  Since  the  number  of  inequalities  of  this  family 
is  0(m4n4),  we  can  find  all  violations  by  total  enumeration. 

Finally,  observe  the  triplet  formed  by  nodes  (1,  3),  (2, 1),  and  (2,  2)  in  Figure  13.  It  is  easy  to  see 
that  all  three  nodes  cannot  be  black  and  simultaneously  have  any  connection  between  them.  We 
analyze  this  inequality  in  Proposition  5. 

Propositions  For  any  triplet  of  nodes  (i.  s).  ( j,t ),  ( k,u ),  where  node  (i,  s)  is  the  center  of  the 
triplet,  xfj  +  x'-f  +  zf  +  x*  +  zf  <  3  is  a  valid  inequality. 

We  described  the  above  inequality  for  the  case  where  node  (i,  s)  is  the  center  of  the  triplet.  Al¬ 
though,  note  that  it  is  possible  to  obtain  two  alternative  inequalities  by  choosing  any  of  the  other 
two  nodes  as  the  center.  We  refer  to  this  family  as  the  triplet  inequalities  and,  since  the  total 
number  of  possible  triplets  is  0(n3m3),  we  can  find  violations  by  total  enumeration.  Finally,  note 
that  this  family  of  inequalities  can  be  easily  generalized  for  A  -tuplcs,  where  k  >  3.  However,  in 
practice  they  are  less  effective  and  harder  to  evaluate,  as  the  total  number  of  A  -tuplcs  if  0(nkmk). 


7  Node  Deletion 


Consider  an  undirected  simple  graph  G(V,£)  having  node  set  V  =  {1,... ,  n},  and  edge  set 
S  C  :  i,  j  are  distinct  nodes  in  V}.  Shen  et  al.  (2012)  examine  the  problem  of  maximally 

disconnecting  G  by  deleting  a  subset  of  no  more  than  B  <  |V|  nodes  (and  all  of  their  incident 
edges).  Define  a  (maximal)  connected  component  as  a  subgraph  such  that  every  pair  of  nodes  in 
the  subgraph  is  connected  by  a  path,  and  no  path  exists  between  a  node  outside  the  subgraph  and 
a  node  belonging  to  the  subgraph.  Another  study  that  we  conducted  as  a  part  of  this  grant  can  be 
found  in  Shen  and  Smith  (Networks,  2013).  We  consider  the  following  network-connectivity  met¬ 
rics,  which  we  apply  to  G  after  some  subset  of  nodes  has  been  deleted  from  it:  (i)  the  number  of 
components  in  G,  (ii)  the  largest  component  size  in  G,  and  (iii)  the  minimum  cost  to  reconnect  the 
graph  after  node  deletions,  given  a  set  of  edge  construction  costs.  We  refer  to  these  three  problems 
as  MaxNum,  MinMaxC,  and  MaxMinLR,  respectively.  If  there  exist  alternative  optima  for  these 
problems,  we  define  an  optimal  solution  as  one  requiring  the  fewest  node  deletions. 

An  intuitive  approach  to  solving  the  problems  we  consider  is  to  greedily  delete  a  node  having  the 
largest  degree  in  the  current  graph  along  with  its  adjacent  edges,  and  reiterate  until  B  nodes  have 
been  deleted.  However,  this  algorithm  does  not  generally  yield  even  a  constant-factor  polynomial¬ 
time  approximation  scheme.  Figure  14  depicts  a  MaxNum  instance  with  B  =  1,  in  which  the 
greedy  algorithm  removes  the  gray  node,  resulting  in  one  component  (excluding  the  deleted  node). 
However,  the  optimal  solution  removes  the  black  node,  yielding  four  components.  (Note  that  by 
increasing  the  number  of  leaf  nodes  adjacent  to  the  black  node,  and  the  number  of  non-leaf  nodes 
adjacent  to  the  gray  node,  we  can  arbitrarily  increase  the  optimality  gap  between  the  heuristic  and 
optimal  objective  function  values.)  Figure  15  depicts  a  MinMaxC  instance  with  B  —  1,  where 
the  greedy  algorithm  deletes  the  highest-degree  node  (colored  gray),  leaving  a  largest  component 
that  has  16  nodes.  However,  the  optimal  solution  deletes  the  black  node,  which  results  in  a  smaller 
largest-component  size  of  five;  again,  this  optimality  gap  can  be  made  arbitrarily  large  by  suitably 
expanding  the  graph.  By  contrast,  we  explore  an  exact  optimization  algorithm  for  these  problems. 
Our  central  approach  for  these  problems  is  inspired  by  bilevel  optimization  techniques  used  in 
network  interdiction  models.  We  formulate  MaxNum,  MinMaxC,  and  MaxMinLR  on  general 
graphs  as  two-stage  network  interdiction  models.  We  then  transform  each  model  into  an  integrated 
mixed  integer  program  (MIP).  For  MaxNum  and  MinMaxC,  we  employ  results  for  tree  structures 
in  the  Shen  and  Smith  (Networks,  2013)  paper,  and  derive  a  class  of  valid  inequalities  designed  to 
improve  the  solvability  of  our  MIPs,  based  on  polynomial-time  DP  solutions  of  subgraphs  derived 
from  G. 


Complexity  Analysis  and  MIP  Formulations.  We  now  formulate  the  three  node  deletion  prob¬ 
lems  as  bilevel  min-max  (or  max-min)  programs,  and  prove  that  each  is  strongly  AfP-hard.  We 
then  demonstrate  how  to  obtain  an  integrated  MIP  model  for  each  node  deletion  problem. 


MaxNum.  We  begin  by  considering  MaxNum,  which  maximizes  the  number  of  components 
after  deleting  a  subset  of  nodes.  Denote  as  MaxNum  the  decision  version  of  MaxNum,  which 
seeks  to  delete  a  subset  of  no  more  than  B  nodes,  such  that  the  number  of  components  in  G  is  at 


least  some  given  integer  target  value  T.  All  proofs  are  contained  in  the  published  paper. 


Theorem  14  MaxNum  is  MV -complete  in  the  strong  sense. 


Now,  to  formulate  MaxNum  as  an  MIP,  define  binary  variables  x% ,  Vi  £  V,  such  that  xt  =  1  if  node 
i  is  not  deleted,  and  Xi  =  0  otherwise.  Also,  define  yl3  £  {0, 1},  V(i,  j)  £  £,  such  that  y.ij  =  0  if 
edge  (i,j)  £  £  is  deleted  (due  to  the  deletions  of  nodes  i,  j,  or  both),  and  y,3  =  1  otherwise.  Note 
that  yij  =  XiXj,  i.e.,  an  edge  is  not  deleted  if  and  only  if  both  of  its  incident  nodes  are  not  deleted. 
Let  y{x,  y )  be  the  number  of  components  remaining  in  G  given  a  deletion  solution  (x,  y ).  We  give 
MaxNum  as 


max  r](x,  y)  -  -  (1  -  xt) 

iev 

s.t.  ^  (1  —  x^  <  B 

iev 

Xi  +  xj  -1  <  yi:j,  y^  <  Xi,  y^  <  x3  £  £ 

Xi  £  (0, 1}  Vi  £  V 

0  <  yl3  <  1  V(i,j)e£. 


(65a) 

(65b) 

(65c) 

(65d) 

(65e) 


In  the  objective  (65a),  we  introduce  a  penalty  term  —  1/n  (1  —  xt)  such  that  if  there  exists 

more  than  one  solution  that  maximizes  the  number  of  components,  a  solution  having  the  fewest 
deleted  nodes  is  chosen  as  an  optimal  solution.  (Note  that  0  <  1  /n£iev  (1  —  Xi)  <  1  for  any 
solution  values  of  x,  and  that  the  function  r]{x,  y)  takes  only  integer  values.  Hence,  the  introduction 
of  this  penalty  term  will  not  generate  suboptimal  solutions.)  Constraint  (65b)  limits  the  number  of 
deleted  nodes  to  be  no  more  than  B,  and  constraints  (65c)  force  yl3  =  1  if  x{  —  x3  =  1,  for  all 
(i,  j)  £  £.  Otherwise,  if  Xi  =  0  or  Xj  =  0,  yl3  will  take  on  a  value  of  0. 

We  next  formulate  the  problem  of  calculating  //(a:,  y)  using  an  MIP  model  on  an  auxiliary  network, 
and  show  that  the  linear  programming  (LP)  relaxation  of  this  formulation  yields  a  convex  hull 
representation  of  the  problem,  given  that  all  y- values  are  binary-valued. 

Let  G(V  U  { 0 } .  A)  denote  a  transformed  directed  network,  where  node  0  will  act  as  a  dummy 
source  node.  Set  A  consists  of  two  directed  arcs  (i,  j)  and  (j,  i)  for  all  edges  (i,  j)  £  £.  Our 
approach  requires  that  a  path  must  exist  in  G  from  node  0  to  each  node  i,  for  every  i  £  V  :  xy  =  1. 
Define  V  =  {i  £  V  :  ay  =  1}  as  the  set  of  active  nodes.  Let  A*  be  a  minimum-cardinality  set  of 
arcs  that  can  be  constructed  between  node  0  and  every  node  in  V,  such  that  there  exists  a  path  from 
node  0  to  i,  Vi  £  V,  using  arcs  in  A  U  A*.  Then  the  number  of  graph  components  equals  A*  j . 

Define  FS(i)  =  {j  :  (i,  j)  £  A}  as  the  set  of  nodes  adjacent  from  node  i,  and  RS(i)  =  {j  : 
( j,i )  £  Vl}U{0}  as  the  set  of  nodes  adjacent  to  node  i,  Vi  £  V.  Also,  FS( 0)  =  Vandf?S'(0)  =  0. 
We  define  binary  variables  for  all  i  £  V,  such  that  zt  —  1  if  we  construct  arc  (0,  i)  (i.e.,  if  we  will 
use  (0,  i)  in  a  path  from  0  to  some  node  in  V),  and  zt  —  0  otherwise.  The  goal  is  to  minimize  the 
number  of  arcs  (0,  i)  constructed  over  all  i  £  V,  subject  to  the  restriction  that  at  least  one  path  can 
be  routed  from  node  0  to  every  active  node  k  £  V.  We  associate  a  different  commodity  with  each 
node  pair  (0,  k),  Vfc  £  V,  and  define  f,3k  as  the  multi-commodity  flow  variable  on  arc  (i,  j)  £  A 


(66a) 


that  routes  a  path  from  node  0  to  node  k  E  V.  The  MaxNum  subproblem  is  given  by 

r]{'x,  y)  =  min  ^zt 
iev 

s.t  fvk  -  h'tk  =  aiXk  v^{0}UV,  fceV,j/lc  (66b) 


jeFS(i)  jeRS(i) 

fojk  <  Zj  Vj,  k  G  V  (66c) 

fijk  <  Uij  v(i,  j)  G  A,  k  G  V  (66d) 

^  G  {0, 1}  Vi  G  V  (66e) 

fijk  >  0  V(i,  j)  G  A,  k  G  V.  (66f) 

Constraints  (66b)  are  multi-commodity  flow  balance  constraints,  in  which  we  define  parameters 
«o  =  1  and  cii  =  0,  Vi  G  V,  i.e.,  there  exists  one  unit  of  flow  originating  at  node  0  and  terminating 
at  node  k,  for  each  k  G  V.  Note  that  constraints  (66b)  do  not  require  any  flow  to  reach  node 
k  G  V  if  it  is  not  active  (i.e.,  if  xk  =  0,  then  fljk  =  0,  V(i,j)  G  A,  and  f0ik  =  0,  Vi  G 


V,  is  feasible).  Constraints  (66c)  indicate  that  no  flow  is  permitted  on  arc  (0,  j),  Vj  G  V,  if 
the  arc  is  not  constructed,  and  constraints  (66d)  prevent  flow  on  arc  (i,j)  G  A  if  it  is  deleted 
(where  y%3  =  y3l,  V(i,  j)  G  A).  Constraints  (66e)  and  (66f)  require  z  to  be  binary,  and  /  to  be 
nonnegative,  respectively.  Formulation  (66)  can  be  extended  for  solving  the  case  where  deleted 
nodes  are  considered  as  singleton  components,  by  simply  changing  the  right-hand-sides  (RHS)  of 
constraints  (66b)  to  a*,  Vi  G  {0}  U  V. 

Next,  we  show  that  solving  (66)  is  equivalent  to  solving  its  LP  relaxation. 

Proposition  6  Let  P  be  the  feasible  region  of  the  LP  relaxation  of  (66)  (in  which  constraints  (66e) 
are  eliminated ).  Given  binary  x  and  y-values,  a  subproblem  solution  (/,  z)  with  a  fractional  z-  or 
f -value  is  not  an  extreme  point  of  P. 

According  to  Proposition  6,  we  reformulate  subproblem  (66)  by  replacing  (66e)  with  Zi  >  0  for 
all  i  G  V,  where  the  upper  bounds  zt  <1  are  unnecessary  noting  that  no  ;j- value  exceeds  1  in 
any  optimal  solution.  Let  n rik,  —a0 ik,  and  —  ai3k  be  dual  variables  associated  with  (66b),  (66c), 


and  (66d),  respectively.  The  dual  of  formulation  (66)  is  given  by: 

rj(x,  y)  =  max  E  E  E  VijOlijk  (67a) 

fcev  (i,j)€A  fcev 

s.t.  (vr0fc  -  7tik )  -  a0ik  <0  Vi,  k  G  V.  i  f  k  (67b) 

(vTifc  -  7 Tjk)  -  aijk  <  0  V(i,  j)  G  A,  k  G  V  (67c) 

Vi  G  V  (67d) 

fcev 

Oioik  E  0,  Vi,  k  G  V;  atjk  >  0,  V(i,j)  G  A,  k  G  V; 

TTfcfc  =  0,  \/k  G  V,  (67e) 


where  (67b),  (67c),  and  (67d)  are  dual  constraints  respectively  associated  with  primal  variables 
foik,  fijk,  and  By  replacing  r/(x,  y)  with  (67a)  in  formulation  (65),  we  obtain  a  bilinear  mixed- 
integer  program  with  nonlinear  terms  of  xkTtQk  and  yijOiijk  existing  in  the  objective  function.  Ob¬ 
serve  that  one  optimal  solution  to  (67)  is  obtained  by  letting  nik  =  zk,  \/k  G  V,  i  G  {0}  U  V,  i  f  k, 


aokk  =  Zk,  V/c  G  V,  and  all  other  n-  and  a-variables  equal  to  zero.  (This  solution  is  feasible  to  (67) 
and  has  the  same  objective  function  value  as  that  to  the  primal,  and  hence  must  be  optimal.)  It  is 
therefore  permissible  to  restrict  our  attention  to  solutions  in  which  all  n-  and  a- values  belong  to 
the  interval  [0,1]. 

Because  all  x-  and  y-variables  are  binary-valued,  by  letting  /30k  =  xkn ok  and  yl]k  =  y^o^/,,  we 
linearize  these  bilinear  terms  using  the  following  inequalities: 

A) k  <  Xk,  /30k  <  vr0 k  Vlcev  (68a) 

7 ijk  >  Vij  +  ®ijk  -  1,  7 ijk  >  0  V(i,  j)  G  A,  k  G  V,  (68b) 

where  we  omit  constraints  /30k  >  0,  (30k  >  xk  +  nok  —  1,  7 ijk  <  yt),  and  y1/jk  <  al]k  because  they 
will  not  be  violated  by  any  optimal  solution.  The  integrated  MaxNum  formulation  is  then  given  by 

MaxNum:  max  E  At* —  E  E  7 ijk  ^  ^  (1  (69) 

fcev  (i,j)eA  fcev  n  iev 

s.t.  (65b)-(65e),  (67b)-(67e),  (68a)-(68b). 


MinMaxC.  Our  next  objective  is  to  minimize  the  largest  component  size  in  the  graph  after  node 
deletions.  The  MinMaxC  objective  function  is  similar  to  the  one  for  MaxNum: 

min  J  r/(y)  +  i  (i  -  xt)  :  (65b)-(65e)  1  ,  (70) 

l  n  iev  J 

where  rj'(y)  represents  the  largest  component  size  given  y.  (Note  that  we  can  equivalently  consider 
rf(y)  as  the  largest  component  size  in  G  including  all  deleted  nodes,  because  each  deleted  node 
is  a  singleton  component.  These  cardinality- 1  components  do  not  increase  the  objective  function 
value  unless  B  >  |V|  and  the  problem  is  trivial.) 


Define  variables  alk  G  (0, 1}  such  that  alk  =  1  if  nodes  i  and  k  belong  to  the  same  component, 
and  aik  =  0  otherwise.  (In  particular,  akk  =  1 ,  Vfc  G  V.)  Letting  A  =  rj'(y)  be  a  variable  that 
represents  the  largest  component  size,  we  give  an  integrated  MIP  formulation  as: 


MinMaxC:  min  A  +  —  V  (1  —  xA  (71a) 

n 

i&V 

s.t.  (65b)-(65e) 

akk  =  1  Wk  G  V  (71b) 

0jk  -  °ik  >  Vij  ~  1  V(i,  j)  G  A,  k  G  V  (71c) 

A  >^cnk  VI;  G  V  (7 Id) 

iev 

Vik  >0  Vi,  k  G  V.  (71e) 


Constraints  (7  Id)  indicate  that  A  >  maxfcgV  {^ieV  where  X^iev  a'ik  calculates  the  cardinality 
of  the  component  to  which  node  k  belongs,  \/k  G  V.  At  optimality,  A  takes  on  its  minimum  feasible 
value,  and  thus  equals  maxfegV  {  ]CiGy  aik  } .  Next,  we  establish  the  following  proposition  to  show 
that  other  constraints  in  (71)  guarantee  feasible  and  binary  a- values  as  defined. 


Proposition  7  Given  binary  y-values,  there  exists  an  optimal  solution  to  (71)  in  which  oik  =  1  if 
and  only  if  node  i  and  node  k  belong  to  the  same  component,  and  cr^  =  0  otherwise. 


MaxMinLR.  The  last  connectivity  metric  that  we  consider  regards  the  minimum  link  construc¬ 
tion  cost  for  reconnecting  a  network.  Our  motivation  for  considering  this  problem  is  that  it  repre¬ 
sents  the  case  in  which  a  two-stage  Stackelberg  game  is  played  between  an  interdicting  agent  and 
some  network  operator.  The  network  operator  will  reconnect  all  surviving  nodes  after  an  attack 
at  minimum  cost,  while  the  interdictor’s  goal  is  to  maximize  the  minimum  cost  that  the  operator 
incurs.  Let  £  be  the  set  of  edges  that  can  be  built  to  reconnect  the  graph  after  edge  deletions,  and 
Cij  be  the  link  construction  cost  associated  with  edge  (i,j),  W(i,  j)  G  £. 

We  begin  by  showing  that  MaxNum  is  a  special  case  of  MaxMinLR.  Note  that  any  MaxMinLR 
instance  in  which  £  =  £,  and  ctj  =  1,  V(i,  j)  G  £,  is  identical  to  a  MaxNum  instance  on  the  same 
graph:  The  number  of  components  in  an  optimal  MaxNum  solution  is  one  fewer  than  the  number 
of  edges  required  to  reconnect  the  graph.  (This  observation  is  true  regardless  of  whether  we  treat 
deleted  nodes  as  entities  that  need  to  be  reconnected  in  the  MaxMinLR  problem.)  Thus,  because 
MaxNum  is  a  special  case  of  MaxMinLR,  and  MaxNum  is  strongly  A/’T’-hard,  then  MaxMinLR 
is  also  strongly  A/’T’-hard.  By  contrast  to  MaxNum  and  MinMaxC,  Theorem  15  shows  that  when 
deleted  nodes  do  not  need  to  be  reconnected,  MaxMinLR  remains  hard  even  when  G  is  a  tree. 


Theorem  15  MaxMinLR  ( without  reconnecting  deleted  nodes )  is  strongly  AfV-hard,  even  if  cl3  is 
binary -valued  for  cdl  ( i,j )  G  £,  and  ifG  is  a  tree. 


We  model  MaxMinLR  as  an  MIP  by  creating  a  directed  auxiliary  graph  G(V,A),  in  which  two 
directed  arcs  (i,j)  and  (j,i)  appear  in  A  associated  with  each  edge  (i,j)  G  £.  Meanwhile,  two 
directed  arcs  (i,j)  and  (j,  i )  appear  in  a  potential  arc  set  A  for  each  edge  (i,j)  G  £  that  may  be 
used  to  reconnect  the  graph.  Recall  that  V  is  the  set  of  all  active  nodes.  We  formulate  the  problem 
of  determining  the  minimum  connection  cost  on  G(V,  A)  as  a  multi-commodity  network  design 
problem,  which  routes  (|V|  —  1)  paths  from  some  active  node  q  to  all  other  active  nodes  (one  path 
each  from  node  q  to  node  i,  Vi  G  V  \  {g}).  Without  loss  of  generality,  we  specify  source  node 
q  as  the  smallest-indexed  active  node.  Define  binary  variables  i/y,  such  that  Wi  —  1  if  node  i  is 
the  smallest-indexed  node  in  V,  and  Wi  —  0  otherwise.  In  the  master  problem,  we  establish  the 
definition  of  w  by  using  the  following  inequalities: 

Wi  <  Xi  Wi  G  V  (72a) 

Wi  <  1  —  Xk  Wi,  k  G  V  :  k  <  i  (72b) 

=  1,  (72c) 

iev 


where  constraints  (72a)  ensure  =  0  if  node  i  has  been  deleted,  and  constraints  (72b)  enforce 
Wi  =  0  if  any  node  k  having  a  smaller  index  than  i  (i.e.,  k  <  i)  has  not  been  deleted.  Constraint 
(72c)  forces  one  eligible  Wi  to  take  a  value  of  1.  The  master  problem  of  MaxMinLR  is  similar 
to  (65)  except  that  the  objective  maximizes  p"{w,x,y)  —  l/n£AeV  (1  —  xf),  where  p"{w,x,y) 


is  the  minimum  link  construction  cost  given  binary  values  w,  x,  and  y,  and  the  constraint  set 
includes  (72a)-(72c). 

Define  FS'(i )  =  {j  :  ( i,j )  G  A  U  A}  as  the  set  of  nodes  potentially  adjacent  from  node  i,  and 
RS'(i )  =  {j  :  ( j ,  i )  G  A  U  A}  as  the  set  of  nodes  potentially  adjacent  to  i,  Mi  G  V.  Let  fijk  be 
the  flow  on  arc  (i,j)  G  A  U  A  corresponding  to  paths  from  node  q  to  node  k,  Mk  G  V.  Define 
binary  variables  zt]  G  {0, 1},  such  that  zt]  =  1  if  we  construct  arc  (/',  j),  and  zl}  =  0  otherwise, 
V(i,  j)  G  A.  The  MaxMinLR  subproblem  is  given  by 


r/"(w,x,y)  =  min  ^  clJzlJ  (73a) 

(iJ)eA 

subject  to:  E  fijk  E  fjik  >Wi-{  1  -  xk)  Mi,  k  G  V.  i  <  k  (73b) 

jeFS'(i)  jeRS'(i) 

fijk  <  Zij  +  ytj  M(i,j)  G  A  U  A,  k  G  V  (73c) 

Zij  <  yij  M(i,j)eA  (73d) 

Zij  e  {0,1}  M{i,j)  G  A  (73e) 

fijk  >  0  M(i,j)  G  A  U  A,  k  G  V,  (73f) 

where  constraints  (73b)  represent  multi-commodity  flow  balance  conditions  at  each  node  i  G  V, 
which  require  the  existence  of  a  path  from  node  q  to  node  k  for  all  active  k  G  V.  Note  that  these 
constraints  are  only  stated  for  all  i,  k  G  V,i  <  k,  because  if  Wi  =  1,  then  x\  —  ■  ■  ■  —  Xi-i  =  0  due 


to  (72b).  Constraints  (73c)  force  fijk  =  0  if  (i,j)  G  A  U  A  is  neither  connected  (i.e.,  yVj  =  0)  nor 
constructed  (i.e.,  %  =  0),  where  yl3  =  0  if  (i,j)  £  A  and  zt]  =  0  if  (i,j)  qL  A.  Constraints  (73d) 
stipulate  that  no  arc  incident  to  any  deleted  node  is  constructed.  Constraints  (73e)  and  (73f)  state 
logical  conditions  on  the  variables. 


Proposition  8  Let  P'  be  the  feasible  region  of  the  LP  relaxation  of  (73)  in  which  integrality  con¬ 
straints  (73e)  are  eliminated.  Given  binary  values  ofw  and  y,  a  subproblem  solution  (/,  z)  with 
fractional  f  or  z  is  not  an  extreme  point  of  Pk 


The  proof  of  Proposition  8  is  similar  to  the  proof  of  Proposition  6  and  is  hence  omitted.  Therefore, 
to  formulate  MaxMinLR  as  a  single  MIP,  we  replace  r]"(w,  x,  y)  in  the  master  problem  by  the  dual 
of  the  LP  relaxation  of  (73),  and  rewrite  all  bilinear  terms  as  a  series  of  linear  inequalities  similar 
to  (68a)  and  (68b). 

Let  Tik,  — 6ijk ,  and  be  dual  variables  associated  with  (73b),  (73c),  and  (73d),  respectively.  In 

particular,  define  rlk  =  0  for  alH,  k  G  V.  i  >  k.  We  present  the  integrated  MaxMinLR  MIP 
model  as  follows. 

max  S  - Tik )  -SI]  Tiifc  -  S  * *)  (74a) 

ieV  keV,k>i  (ij)eAuA  {i,j)eA 

s.t.  (65b)-(65e),  (72a)-(72c) 

fk  ~  Pk  ~  Oijk  <0  M(i,  j)  G  A  U  A,  k  G  V 


(74b) 


E  -  t-G  -  °ij  V(i,j)  e  .4  (74c) 

fcev 

<  Wi,  a'ik  <  Tik  Vi,  k  E  V.  i  <  k  (74d) 

/5-fc  <  Xfc,  /5-fc  <  rifc  Vi,  k  E  V,  i  <  k  (74e) 

>  Vij  +  dijk  -  1,  Tijfc  >  0  V(i,  j)  E  Vl  U  >4,  k  E  V  (74f) 

^  >  j/ij  +  l-k3  -  1,  S-j  >  0  V(i,  j)  E  A  (74g) 

Tjfe  >0  Vi,  k  E  V,  i  <  k]  0ijk  >  0  V(i,  j)  E  A  U  *4.,  k  E  V] 

IMj  >  0  V(i,j)d.  (74h) 


Constraints  (74b)  and  (74c)  are  dual  constraints  associated  with  primal  variables  V(i,  j)  E  AU 
A,  k  EV  and  V(i,  j)  E  A,  respectively.  We  define  a'fc  =  WiTik,  j3'ik  =  xkrik,  iijk  = 
and  f)7  =  y,?/iZ)  in  the  objective,  and  enforce  these  relationships  via  constraints  (74d),  (74e),  (74f), 
and  (74g),  respectively,  as  before. 


Bounds  and  Inequalities  for  MaxNum  and  MinMaxC.  We  now  discuss  strategies  for  bounding 
the  optimal  objective  function  values  for  MaxNum  and  MinMaxC,  and  using  the  obtained  bounds 
to  tighten  the  MIP  formulations  for  these  problems.  Shen  and  Smith  (2012,  Networks)  prescribe 
polynomial-time  optimal  DP  algorithms  for  MaxNum  and  MinMaxC  on  A-holc-graphs  (where  k 
is  a  constant).  We  do  not  carry  out  this  analysis  for  MaxMinLR,  as  Theorem  15  indicates  that  it  is 
not  solvable  (in  general)  in  polynomial  time,  even  when  G  is  a  tree,  unless  V  =  AfV. 

We  begin  by  describing  mechanisms  for  bounding  the  connectivity  objectives,  i.e.,  the  number 
of  components  in  MaxNum,  and  the  largest  component  size  in  MinMaxC.  Denote  xq  and  x'G  as 
optimal  solutions  to  MaxNum  and  MinMaxC  on  G,  respectively.  Also,  let  ric(x)  equal  the  number 
of  components,  and  rfG(x)  equal  the  largest  component  size,  after  we  delete  a  subset  of  nodes 
(and  their  incident  edges)  associated  with  solution  x  on  graph  G .  We  first  establish  the  following 
proposition. 


Lemma  11  For  any  subgraph  Gs{V.  £$)  ofG,  we  have: 

Vg{xGs )  <  Vg(xg)  <  VGs(xgs)  (75a) 

Vg(x'gs)  ^  Vg(xg)  >  Vgs(xgs)-  (75b) 

In  our  implementation,  we  specify  a  priori  some  value  kmilK  that  denotes  the  maximum  number 
of  holes  that  we  allow  in  any  induced  subgraph  of  G,  and  generate  a  series  of  m  subgraphs  of  G, 
denoted  as  H1, . . . ,  Hm,  in  which  Hl  is  a  /crhole-graph  (kt  <  A;max),  V/  =  1, . . . ,  m.  According  to 
Lemma  11,  the  following  bounds  are  valid: 

max  {pG  (xHi)}  <  pG(xG)  <  min  {qHi{xHi)}  (76a) 

1=1,..., m  1=1,..., m 

,  min  {r)G  (xhI)}  >  rjG(xG)  >  max  {rfHl  (xHl)}  .  (76b) 

1=1,..., m  1=1,..., m 


Given  the  bounds  established  in  (76a)  and  (76b),  we  now  turn  our  attention  to  employing  these 
bounds  within  a  graph  partitioning  strategy  that  generates  valid  inequalities  for  MaxNum  and  Min- 
MaxC.  Given  G(V,  £),  we  partition  V  into  m  nonempty  subsets  10, . , . ,  V,n,  such  that  10  H  10-  =  0 
for  all  i,  j  =  1, ...  ,m,  i  ^  j  and  10  =  V.  Each  partition  10  yields  a  subgraph  G0(10,  E{ ),  in 
which  Et  =  {(u,  v)  G  S  \  u,  v  e  10}  is  induced  by  nodes  in  10.  (Note  that  if  G  is  connected  and 
m  >  2,  then  (J'0 ,  E,  c  £.)  Let  k,  be  the  number  of  holes  in  each  subgraph  G,.  "it  =  l. ... .  rri. 

We  then  execute  the  DP  algorithm  of  Shen  and  Smith  on  each  kr hole  subgraph  G,  given  a  node 
deletion  budget  of  B.  As  is  typical  in  DP  schemes,  we  obtain  the  optimal  connectivity  objective 
values  corresponding  to  every  node  deletion  budget  value  T0  =  0, . . . ,  B.  These  values  allow  us  to 
construct  functions  that  reflect  relationships  between  the  connectivity  objective  values  and  budgets 
in  MaxNum  and  MinMaxC  over  G, ,  which  yield  valid  inequalities  for  their  respective  MIPs. 

We  first  present  the  development  of  our  valid  inequalities  in  the  context  of  the  MaxNum  problem. 
Let  rji(Bi)  be  the  maximum  number  of  components  that  we  can  obtain  in  G,  given  deletion  budget 
Bi  =  0, . . . ,  B.  Let  variable  r/  represent  the  optimal  connectivity  objective  value  for  solving 
MaxNum  on  G,  and  let  t/,  be  a  variable  representing  the  optimal  connectivity  objective  value 
for  solving  MaxNum  on  Gi:  Vi  =  1, . . .  ,m.  We  construct  a  piecewise-linear  concave  envelope 
function  g^Bj)  of  //t(70),  such  that  //, ( Ii, )  <  g,  ( Bt )  for  each  B,  -=  0. ....  B.  We  use  the  tightest 
such  function  possible,  in  which  every  linear  segment  of  gi(Bi)  touches  at  least  two  points  on  the 
function  rji(Bi),  assuming  that  B  >  1.  We  append  the  following  system  of  valid  inequalities  into 
the  MaxNum  formulation,  where  Bi  is  now  released  as  a  variable  representing  the  number  of  node 
deletions  that  take  place  over  10. 

m 

v  -  Vi  <  ° 

i= 1 

rji  -  gi(Bi)  <  0  Vi  =  1, . . . ,  m 
Bj  =  ^  (1  -  Xj)  Vi  =  1, ... ,  m, 

j&Vi 

where  (77a)  is  due  to  the  fact  that  the  partition  procedure  automatically  eliminates  all  edges  be¬ 
tween  each  pair  of  G0,  Vi  =  1 , ,m,  and  thus  it  creates  at  least  as  many  components  as  solving 
the  original  problem  on  G.  Constraints  (77b)  are  nonlinear  constraints  that  can  be  substituted  by 
a  set  of  linear  functions,  each  of  which  corresponds  to  a  segment  of  gi(Bi),  for  all  i  =  1, . . . ,  m. 
Constraints  (77c)  define  B,  as  the  number  of  node  deletions  taking  place  in  set  10. 


(77a) 

(77b) 

(77c) 


8  Defending  and  Interdicting  NP-hard  Problems 


Lozano  and  Smith  (2015)  consider  defender-attacker-defender  problems  that  are  modeled  as  three- 
level,  two-player  Stackelberg  games.  In  the  first  stage  a  defender  (also  known  as  the  “owner”  or 
“operator”)  can  fortify  a  subset  of  assets,  while  in  the  second  stage  an  attacker  (often  called  the 
“interdictor”)  destroys  a  subset  of  the  unprotected  assets.  The  attacker’s  goal  in  the  second  stage  is 
to  maximize  damage  to  the  defender’s  objective,  which  is  determined  by  solving  an  optimization 
problem  in  the  third  stage,  using  the  surviving  assets  from  the  initial  system. 


Formally,  let  w,  x,  and  y  be  the  decision  variables  for  the  first-,  second-,  and  third-stage  problems, 
respectively.  We  assume  that  the  third-stage  problem  can  take  any  general  form,  while  the  first- 
and  second-stage  problems  include  only  binary  variables,  i.e.,  w  e  {0,  l}Hw  and  x  e  {0,  l}nx, 
where  nw  (nx)  is  the  number  of  variables  required  to  model  asset  fortification  (attack).  Let  W  be 
the  set  of  feasible  solutions  to  the  first-stage  problem.  Let  A(w)  be  the  set  of  feasible  second-stage 
solutions  given  a  defense  vector  w,  and  let  jP(x)  be  the  set  of  feasible  third-stage  solutions  for  a 
given  attack  vector  x.  Also,  define  X  =  U  A(w)  and  y  =  |^J  jP(x),  i.e.,  X  and  y  are  the 

wGW  X(E  A 

set  of  all  possible  second-  and  third-stage  feasible  solutions,  respectively.  Finally,  let  /( y)  be  the 
defender’s  objective  function.  We  study  problems  of  the  form: 

V  :  z*  =  min  max  min  /( y),  (78) 

wGW  xGA(w)  yEy(x) 

We  refer  to  the  first-,  second-,  and  third-stage  problems  as  fortification,  attack,  and  recourse  prob¬ 
lems,  respectively. 

These  problems  have  multiple  applications  in  areas  such  as  military  and  homeland  security  opera¬ 
tions,  facility  protection,  survivable  network  design,  and  power  grid  protection.  At  a  more  abstract 
level,  interdiction  problems  can  often  be  modeled  as  games  that  take  place  over  networks  having 
well-studied  recourse  problems.  Some  of  these  network  interdiction  problems  include  shortest 
path,  maximum  flow,  and  multicommodity  flow  studies.  Of  particular  interest  are  previous  studies 
on  defender- attacker-defender  problems  that  fit  within  our  problem  framework. 

We  present  a  novel  backward  sampling  framework  for  solving  three-  (and  two-)  stage  interdiction 
problems  in  which  the  recourse  problem  can  take  any  form  (e.g.,  it  can  be  nonlinear,  and  can  have 
integer  variables),  provided  that  all  variables  in  the  first  two  stages  are  restricted  to  be  binary¬ 
valued.  This  framework  is  primarily  designed  to  improve  the  solution  of  the  interdiction  problem, 
by  solving  relatively  easy  interdiction  problem  relaxations  in  which  the  defender  is  restricted  to 
choose  its  recourse  actions  from  a  sample  of  the  third-stage  solution  space.  These  problems  pro¬ 
vide  upper  bounds  on  the  optimal  interdiction  solution;  lower  bounds  can  then  be  obtained  by 
fixing  an  interdiction  solution  and  optimizing  the  (original)  recourse  problem  as  a  function  of  the 
fixed  interdiction  actions.  This  framework  avoids  linearizing  a  (potentially  large)  bilinear  pro¬ 
gram,  and  also  eliminates  the  need  for  applying  combinatorial  Benders’  cuts  at  the  interdiction 
stage  (although  we  still  require  them  to  solve  the  fortification  problem). 

Using  our  framework,  we  construct  an  algorithm  for  the  shortest  path  interdiction  problem  with  for¬ 
tification  (SPIF)  that  compares  favorably  to  the  current  state-of-the-art  algorithm,  finding  optimal 
solutions  over  random  grid  networks  having  up  to  3,600  nodes  and  17,000  arcs,  and  over  real-road 
networks  having  up  to  300,000  nodes  and  more  than  1,000,000  arcs.  We  also  consider  the  capac¬ 
itated  lot  sizing  interdiction  problem  with  fortification  (CLSIF),  in  which  the  NP-hard  third-stage 
problem  is  modeled  as  a  MIP.  We  extend  our  framework  to  solve  the  CLSIF,  and  demonstrate  its 
ability  to  solve  instances  of  this  new  problem  class. 


The  Backward  Sampling  Framework.  The  core  idea  behind  the  backward  sampling  frame¬ 
work  is  to  iteratively  sample  the  third-stage  solution  space  so  that  instead  of  solving  the  original 


problem  V  directly,  we  solve  restricted  problems  defined  over  smaller  recourse  solution  spaces. 
The  sampling  procedure  selects  a  subset  of  third-stage  solutions  y  C.y,  and  throughout  the  algo¬ 
rithm  augments  y  with  new  third- stage  solutions  from  y.  The  sampling  procedure  would  ideally 
be  able  to  quickly  identify  several  near-optimal  solutions;  however,  we  do  not  require  this  proce¬ 
dure  to  guarantee  the  generation  of  any  new  solutions  in  order  for  our  framework  to  converge  to  an 
optimal  solution.  An  appropriate  strategy  would  tailor  the  sampling  procedure  for  the  problem  at 
hand,  as  would  be  done  for  heuristic  approaches. 

For  any  attack  vector  x  and  third-stage  solution  sample  y,  we  denote  by  J?(x)  =  y  fl  jP(x)  the 
subset  of  solutions  that  belong  to  y  and  are  feasible  given  the  attack  vector  x.  Anticipating  the  case 
for  which  there  exists  an  attack  x  G  X  for  which  ^P(x)  =  0,  we  seed  y  with  an  artificial  third-stage 
solution  ya  that  cannot  be  interdicted  and  has  objective  value  f(ya )  =  oo.  This  artificial  solution 
ensures  that  jP(x)  ^  0  for  any  xGf. 

Consider  any  feasible  defense  vector  w  G  W  and  let 

Q(w)  :  zI(w)  =  max  min  /( y)  (79) 

xe*(w)  yey(x) 

be  its  associated  two-level  interdiction  problem.  Note  that  if  there  exists  a  defense  w  G  W  such 
that  A(w)  =  0,  then  problem  (79)  is  not  defined.  Hence,  without  loss  of  generality,  we  assume 
that  A(w)  ^  0,  Vw  G  W. 

Let  y  C  y  be  any  third- stage  solution  sample  and 

Q(w,  y)  :  zJ(w,  y)  —  max  min  /( y)  (80) 

xe*(w)  yey(x) 

be  the  restricted  problem  in  which  recourse  (third-stage)  decisions  are  restricted  to  y.  The  fol¬ 
lowing  result  establishes  that  solving  a  restricted  problem  Q(w,  y)  yields  a  valid  upper  bound  on 
zJ(w),  which  is  in  turn  a  valid  upper  bound  on  z*. 

Proposition  9  Consider  any  w  G  VV  and  third-stage  solution  sample  y  C  y.  Then  we  have 

z\vf,y)  >  z\ w)  >  z*. 


All  proofs  can  be  found  within  the  work  of  Lozano  and  Smith  (2015). 

We  now  establish  conditions  under  which  we  can  obtain  an  optimal  solution  to  Q(w),  for  some 
w  G  W,  from  a  restricted  problem  Q(w,  jl7).  First,  let  (x.  y)  be  an  optimal  solution  to  the  restricted 
problem  Q(w,  j)).  We  say  that  zr(w.  >')  is  the  perceived  damage  of  x  given  y,  because  the 
interdictor  perceives  that  the  recourse  decision  must  come  from  y.  However,  the  defender  may 
instead  select  from  uninterdicted  solutions  in  y,  and  so  we  define  the  real  damage  of  attack  x  over 
the  original  third- stage  solution  space  y  as 

zR(Z)  =  min  /( y).  (81) 

yey(x) 

Observe  that  zR{x)  <  ^(w)  <  z\ w,  y)  for  any  x  G  A(w).  Proposition  10  states  a  condition  in 
which  an  optimal  solution  to  Q(w,  y)  also  optimizes  Q(w). 


Proposition  10  Let  w  e  W  be  a  feasible  defense,  y  be  a  third-stage  solution  sample,  and  (x,  y) 
be  an  optimal  solution  to  Q(w.  3^).  If  z1  (w.  y)  =  zR(x),  then  (x,  y)  optimizes  Q(w). 

Our  algorithm  uses  these  results  to  solve  Q(w),  given  w  e  W,  by  iteratively  solving  restricted 
problems  Q(  w.  yi)  defined  over  different  third-stage  samples  yi  C  y.  Algorithm  15  presents  this 
approach,  in  which  each  iteration  i  yields  an  upper  bound  UR*  on  z1  (w)  from  solving  Q(w,  jUj, 
and  a  lower  bound  LB,  on  z7(w)  by  obtaining  x:R(x),  for  some  x  e  A’(w).  As  we  will  demonstrate, 
the  sequence  of  UBt-\ alues  is  nonincreasing,  although  the  LR,-valucs  need  not  be  monotone.  The 
main  while-loop  (line  2)  is  executed  until  the  optimality  condition  described  in  Proposition  10  is 
met.  Line  4  solves  the  restricted  problem  Q(w,  y )  defined  over  the  current  sample  y\  Line  5 
calculates  the  real  damage  zR(x)  for  attack  x  and  sets  LB,  equal  to  this  value  (see  Remark  1  for 
additional  explanation).  Line  6  creates  yi+l  by  including  solutions  in  yi  along  with  y*,  i.e.,  an 
optimal  third-stage  response  to  attack  x. 

If  the  perceived  damage  obtained  is  less  than  the  upper  bound  at  the  previous  iteration,  then  a  new 
upper  bound  on  zr(w)  has  been  obtained,  and  the  algorithm  executes  lines  8-9.  Line  8  removes 
from  yi+1  solutions  whose  objective  value  is  greater  than  UB,,  and  line  9  attempts  to  add  new 
solutions  to  yi+l  from  34/«,  =  {y  G  y  \  /( y)  <  LB, }.  If  the  optimality  condition  in  line  11  is 
satisfied,  then  line  12  returns  an  optimal  solution. 


Algorithm  15:  Solving  bilevel  interdiction  problem  0 (  w )  via  backward  sampling 
Input  :  Problem  V  and  a  feasible  defense  w  e  W 
Output:  An  optimal  solution  to  Q(w) 

1  Initialize  UB0  =  oo  and  LB0  =  —  oo,  select  yl  C  >'  as  a  sampling  of  the  third-stage  solution 
space,  and  set  counter  i  =  0; 

2  while  LBt  <  UB  ,  do 

3  I  Set  i  —  i  +  1; 


4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 


Solve  UB,  =  z\ w,  yi)  =  max  min  /( y)  and  obtain  an  optimal  solution  (x,  y); 

xeA’(w)  yeyi(x) 

Solve  LBi  =  ^^(x)  =  min  /( y)  and  obtain  an  optimal  solution  y*; 

yey(x) 

Set  y+1  =  yu{y*}; 

if  UB,  <  UB,  _  i  then 

Remove  from  yi+l  all  solutions  having  objective  value  greater  than  UB,: 

Add  to  yi+1  a  subset  of  new  solutions  in  yUB , ; 

end 

if  LB  ,  =  UB  ,  then 

|  Terminate  with  solution  (x.  y); 

end 


Proposition  1 1  shows  that  the  sequence  of  UR, -values  obtained  is  nonincreasing,  and  Proposition 
12  states  the  finiteness  and  correctness  of  the  proposed  algorithm. 


Proposition  11  The  upper  bounds  UB,  produced  by  Algorithm  15  are  nonincreasing,  and  at  iter¬ 
ation  i,  ybBi  c  C...C  Yud)’  where  ylm,  =  {y  e  P  I  /(y)  <  ^}. 

Proposition  12  Algorithm  15  terminates  finitely  with  an  optimal  solution. 


Optimizing  the  Defense  Decisions.  We  now  propose  an  approach  to  solve  the  three-level  prob¬ 
lem  V.  This  approach  is  based  on  the  identification  of  critical  attacks,  i.e.,  attacks  that  must  be 
blocked  in  order  to  improve  the  defender’s  incumbent  objective  value.  Formally,  we  define  a  criti¬ 
cal  attack  as  any  attack  x  such  that  its  real  damage  zR(x)  is  greater  than  or  equal  to  a  target  upper 
bound  Our  approach  adds  a  covering  constraint  wTx  >  1  to  the  fortification  problem  for  each 
critical  attack  x,  which  states  that  at  least  one  of  the  assets  attacked  by  x  must  be  fortified. 


Proposition  13  For  problem  V  having  optimal  objective  value  z*,  consider  any  attack  x  e  T.  If 
z*  <  zRfk),  then  any  optimal  solution  (w*,  x*,  y*j  satisfies  w*Tx  >  1. 


These  covering  constraints  can  be  seen  as  a  general  case  of  the  combinatorial  Benders’  cut  (Codato 
and  Fischetti,  2006)  where  the  fortification  problem  acts  as  a  master  problem  and  Q(w)  as  a 
subproblem.  Similar  so-called  supervalid  inequalies  were  introduced  by  Israeli  and  Wood  (2002) 
for  a  two-level  shortest  path  interdiction  problem. 

Our  approach  explores  different  defense  vectors  w  £  W  and  solves  the  associated  interdiction 
problems  Q(w)  with  a  variation  of  Algorithm  15  that  stops  whenever  it  identifies  a  critical  attack. 
When  such  an  attack  is  identified,  the  algorithm  adds  a  covering  constraint  to  the  fortification  prob¬ 
lem,  forcing  the  defender  to  block  each  identified  critical  attack.  When  the  fortification  problem  be¬ 
comes  infeasible,  the  algorithm  terminates  with  the  incumbent  solution  being  optimal.  This  process 
must  eventually  terminate  with  an  infeasible  first-stage  problem  because  X (w)  0,  Vw  £  W,  by 

assumption. 

Algorithm  16  presents  the  proposed  approach.  Let  C  be  the  set  of  covering  constraints  added  to 
the  fortification  problem  and  W(C)  =  (w  £  W  |  w  satisfies  all  constraints  in  C}.  The  algorithm 
starts  with  C  =  0  and  a  global  upper  bound  z  —  oo.  The  main  while-loop  (in  line  2)  is  executed 
until  the  fortification  problem  becomes  infeasible.  The  two  main  steps  inside  this  while-loop  are 
selecting  a  feasible  defense  w  £  WiC)  (in  line  4),  and  solving  its  associated  interdiction  problem 
Q(w)  with  a  variation  of  Algorithm  15  (lines  5-22).  The  inner  while-loop  (in  line  6)  is  executed 
until  LB,  =  zR(x)  >  z,  for  some  x  £  X (w),  indicating  that  x  is  a  critical  attack.  At  this 
point,  Algorithm  16  stops  solving  Q(w)  and  adds  a  covering  constraint  to  C.  Finally,  lines  7-21 
replicate  Algorithm  15,  except  for  updating  the  global  upper  bound  5  (in  line  12),  adding  a  covering 
constraint  to  C  if  a  critical  attack  is  identified  (in  lines  16-18),  and  updating  the  incumbent  solution 
when  an  optimal  solution  to  Q(w)  has  an  objective  value  equal  to  z  (in  lines  19-21). 

Algorithm  16  terminates  finitely  because  each  critical  attack  x  £  X  triggers  the  generation  of  a 
covering  constraint  to  C,  which  excludes  the  fortification  action  w  from  WiC).  Finite  termination 
of  the  algorithm  then  follows  from  the  finiteness  of  W  and  from  Proposition  12. 


Algorithm  16:  Backward  sampling  framework 
Input  :  Problem  V 
Output:  An  optimal  solution  to  V 

1  Initialize  the  global  upper  bound  z  =  oo  and  covering  constraints  set  C  =  0; 
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3 
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Select  y1  U  y  as  a  sampling  of  the  third-stage  solution  space  and  set  counter  i  =  0; 
while  W(C)  y  0  do 
Select  w  e  W(C); 

Initialize  UB,  =  oo  and  L/I,  =  —  oo; 
while  LB  ,  <  o  do 
Set  i  —  i  +  1; 

Solve  UB,  =  z:(w,  yi)  =  max  min  /( y)  and  obtain  an  optimal  solution  (x,  y); 

xea:(w)yej)i(x) 

Solve  LB,  =  zRCx)  =  min  /( y)  and  obtain  an  optimal  solution  y*; 

y  ey(x) 

Set  j>i+1  =  U  {y*}; 

if  UB  j  <  z  then 

j  Update  global  upper  bound  5  UB,-, 
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23 

24 


Remove  from  y,+l  all  solutions  having  objective  value  greater  than  UB,  -, 
Add  to  yi+l  a  subset  of  new  solutions  in  yUBi ; 

end 

if  LB  ,  >  o  then 

j  Add  the  covering  constraint  wTx  >  1  to  C; 

end 

if  LB,  =  UB,  =  z  then 

j  Update  the  incumbent  solution  (w,  x,  y)  (w,  x,  y); 

end 

end 

end 

Return  (w,  x,  y); 


The  correctness  of  Algorithm  16  results  directly  from  Propositions  9  and  13.  Note  that  the  upper 
bound  5  is  nonincreasing  throughout  the  execution  of  the  algorithm.  Proposition  13  states  that 
each  of  the  covering  constraints  is  necessary  in  order  to  achieve  an  objective  value  less  than  z.  As 
a  result,  once  W(C)  becomes  empty  we  conclude  that  z*  >  z.  Since  z  is  an  upper  bound,  we  also 
have  that  U  <  z,  which  guarantees  that  the  algorithm  terminates  with  the  optimal  value  z  =  z* . 
For  any  w  that  reduces  z,  the  algorithm  solves  Q(w)  to  optimality,  i.e.,  until  LB,  =  UB,  =  z,  and 
updates  the  incumbent  solution.  As  a  result,  the  algorithm  terminates  with  an  optimal  incumbent 
solution  since  its  objective  value  is  equal  to  z  =  z*. 


Accelerating  the  Algorithm.  We  now  describe  a  mechanism  designed  to  reduce  the  number  of 
restricted  interdiction  problems  that  are  solved  to  optimality.  The  idea  is  to  “pause”  the  exploration 
of  any  w  e  W  whenever  the  potential  relative  improvement  to  the  current  global  upper  bound  is 
sufficiently  small.  At  this  point,  we  add  a  tentative  covering  constraint  to  the  fortification  problem. 


guessing  that  the  best  known  attack  x  corresponding  to  w  is  critical  (which  it  will  indeed  be  if  the 
global  upper  bound  is  reduced  by  a  relatively  small  amount).  We  store  w  in  a  waiting  list  to  be 
revisited  later  in  the  execution  of  the  algorithm,  at  which  time  we  either  confirm  that  x  was  critical 
and  discard  w  from  the  waiting  list,  or  conclude  that  the  attack  may  not  be  critical  and  continue 
exploring  w. 

Formally,  let  C  be  the  set  of  covering  constraints  derived  from  (known)  critical  attacks  and  C,p  be  the 
set  of  tentative  covering  constraints.  Let  £  be  a  waiting  list  that  stores  triples  (w ,zR{k),^>),  where 
w  is  a  defense  vector  that  must  be  revisited,  27' (x)  is  the  real  damage  for  an  attack  x  e  A(w)  that 
we  guess  is  critical,  and  ^  is  the  corresponding  covering  constraint.  Algorithm  17  formally  states 
the  accelerated  backward  sampling  algorithm.  If  W(C  U  Cp)  ^  0,  then  line  4  selects  a  defense 
w  G  W(C  U  Cv;)  and  lines  5-21  explore  problem  Q(w)  as  in  Algorithm  16.  When  x  has  not  been 
shown  to  be  critical,  line  22  computes  the  ratio  (z  —  LBi)/z,  assuming  that  z  >  0,  to  measure 
the  percent  reduction  to  z  that  could  be  achieved  by  continuing  to  solve  Q( w).  If  this  ratio  is  not 
greater  than  some  parameter  e  >  0,  then  lines  23-24  store  (w,  zR(x),  wTx  >  1)  in  £,  add  the 
corresponding  tentative  covering  constraint  to  C^,  and  stop  the  exploration  of  the  current  w.  When 
W(C  U  Cv>)  =  0,  if  ^  0,  then  lines  29-38  reconsider  the  items  stored  in  the  waiting  list.  The 
first  for-loop  (in  lines  29-33)  iterates  over  £  and  moves  from  C ^  to  C  all  the  covering  constraints 
corresponding  to  attacks  with  zR{Stk)  >  z,  discarding  the  associated  wk  from  further  exploration. 
Note  that  if  zR(x.k)  =  z,  then  we  cannot  yet  discard  wk:  even  if  z  =  z*,  the  algorithm  might 
not  have  updated  the  incumbent  (w,  x,  y).  The  second  for-loop  (in  lines  34-38)  iterates  over  the 
remaining  items  in  £  and  resumes  exploration  for  any  wk  that  is  still  in  VV(C),  but  with  e  =  0. 
Finally,  line  39  discards  the  remaining  constraints  in  CR,  empties  the  waiting  list,  and  returns  to  the 
main  while-loop. 


Algorithm  17:  Backward  sampling  framework  with  waiting  list 
Input  :  Problem  V  and  a  threshold  parameter  e  >  0 
Output:  An  optimal  solution  to  V 

1  Initialize  z  =  oo,  covering  constraints  sets  C  =  0,  =  0,  and  waiting  list  C  =  0; 

2  Select  yl  as  a  sampling  of  the  third-stage  solution  space  and  set  counter  i  =  0; 

3  while  W(C  U  C^)  ±  0  do 

4  Select  w  G  W(C  U  C^); 

5  Initialize  UB,  =  oo  and  LB,  =  —oo; 

6  while  LB  ,  <  5  do 

7  Set  i  —  i  +  1; 

8  Solve  UB,  =  z\ w,  j)®)  =  max  min  /(y)  and  obtain  an  optimal  solution  (x,  y) 

x6^(w)  y ey^x) 

Solve  LB,  =  ^^(x)  =  min  /( y)  and  obtain  an  optimal  solution  y*; 

yeV(x) 

9  Sety:+1  =  y:U{y*}; 

10  if  UB,  <  7  then 

11  Update  global  upper  bound  z  UB,  ; 

12  Remove  from  yi+l  all  solutions  having  objective  value  greater  than  UB,  ; 

13  Add  to  y+1  a  subset  of  new  solutions  in  yUB. ; 

14  end 

15  if  LB*  >  z  then 

16  |  Add  the  covering  constraint  wTx  >  1  to  C; 

17  end 

is  if  LB,  =  UB,  =  z  then 

19  |  Update  the  incumbent  solution  (w,  x,  y)  •(—  (w,  x,  y); 

20  end 

21  if  (z  —  LB i)/z  <  e  and  LB,  <  z  then 

22  Add  (w,  ^^(x),  wTx  >  1)  to  the  waiting  list  C; 

23  Add  the  covering  constraint  wTx  >  1  to  CL  and  go  to  line  4; 

24  end 

25  end 

26  end 

27  if  C*  y  0  then 

28  for  (wfc,  zR(x.k),yk)  e  C  do 

29  if  zR(xk )  >  z  then 

30  |  A 

31  end 

32  dd  y>k  to  C,  remove  y>k  from  C^,  and  remove  (wfc,  zR{xk),yk)  from  C; 

33  end 

34  for  ( wk ,  zR(x.k),ipk)  G  C  do 

35  if  wfc  G  W(C)  then 

36  |  R 

37  end 

38  esume  solving  <2(wfc)  with  a  threshold  e  =  0; 

39  end 

40  Reset  <—  0,  £  G-  0,  and  go  to  line  3; 

41  end 

42  Return  (w,  x,  y); 


Shortest  Path  Interdiction  Problem  with  Fortification.  The  SPIF  is  formally  defined  on  a  di¬ 
rected  graph  Q  =  (A/",  A),  where  A f  is  the  set  of  nodes  and  A  C  M  x  J\f  is  the  set  of  arcs,  s  is 
the  source  node,  and  t  is  the  destination  node.  For  each  arc  (i,j)  G  A  there  are  two  nonnegative 
attributes:  the  cost  ci3  >  0  of  traversing  the  arc,  and  the  delay  (or  penalty)  dij  >  0  incurred  when 
traversing  an  interdicted  arc  (so  that  crossing  an  interdicted  arc  costs  c,l3  +  dl3).  Let  w  be  the 
fortification  decision  variables  defined  over  the  arcs,  where  W  =  {w  :  eTw  <  Q,  w  G  (0,  l}!-4!} 
enforces  a  cardinality  constraint  on  the  number  of  fortified  arcs  and  ensures  that  the  variables  are 
binary.  Similarly,  let  x  G  A (w)  be  the  second-stage  attack  decision  variables,  where  X (  w)  = 
{x  :  eTx  <  B ,  xi3  <  1  —  wi3  V(i,  j)  G  A,  x  G  (0,  l}!-4!}  ensures  that  a  maximum  of  B  unpro¬ 
tected  arcs  are  attacked,  and  forces  the  x-variables  to  be  binary.  Finally,  let  y  be  the  third-stage 
arc-flow  variables.  The  SPIF  can  be  formally  stated  as: 


mm  max  mm  )  ( +  c/,,. 

weWxer(w)  ' 

(*d)e. 4 

S-t.  Dij  —  Vji 

Vij  >  0,  V(i,j)eA, 


(82) 


1, 

for  i  =  s 

0, 

for  i  G  A/"\{s,  t} 

(83) 

1, 

for  i  =  t 

(84) 

where  in  the  objective  function  (82),  the  original  cost  of  any  arc  is  increased  by  dl3  when  the  arc  is 
attacked  (i.e.,  xl3  =  1).  Constraints  (83)  define  the  shortest  path  flow  conservation  constraints,  and 
(84)  restrict  the  y-variables  to  be  nonnegative. 


The  implementation  of  the  backward  sampling  framework  for  the  SPIF  requires  a  sampling  scheme, 
an  algorithm  for  solving  two-level  shortest  path  interdiction  problems  restricted  over  a  sample  of 
s-t  paths,  and  a  method  to  solve  third-stage  shortest  path  problems.  The  latter  is  simply  accom¬ 
plished  via  Dijkstra’s  algorithm.  We  discuss  the  first  two  components  of  our  approach  in  the 
following  subsections. 

We  adapt  the  pulse  algorithm  for  the  constrained  shortest  path  problem  to  sample  s-t  paths  from 
Q.  The  pulse  algorithm  conducts  a  recursive  implicit  enumeration  of  the  solution  space,  supported 
by  pruning  strategies  that  efficiently  discard  a  vast  number  of  suboptimal  solutions.  The  algo¬ 
rithm  conducts  a  depth-first  search  beginning  at  s.  When  a  partial  path  is  pruned  or  the  search 
reaches  node  t,  the  algorithm  backtracks  and  continues  the  search  through  unexplored  regions  of 
the  solution  space. 


We  implemented  two  pruning  strategies:  bound  and  arc-usage  pruning.  The  bound  pruning  strat¬ 
egy  discards  any  path  whose  cost  exceeds  the  current  upper  bound  z.  To  do  so,  we  first  obtain  the 
minimum  cost  needed  to  reach  node  t  from  any  node  i,  denoted  by  cit.  Then,  we  prune  any  partial 
path  from  node  s  to  node  i  with  cost  csi,  such  that  csi  +  cit  >  z. 

In  the  arc-usage  pruning  strategy,  we  define  an  upper  limit  u  on  the  number  of  paths  in  y  that 
can  use  any  arc  (i,  j).  Let  u.l3  be  the  number  of  paths  in  y  that  use  arc  When  the  search 

reaches  node  t,  we  add  an  s-t  path  to  y  and  increase  ul3  by  one,  for  each  arc  (i,j)  traversed  in  the 
path.  Once  Uij  =  u,  we  eliminate  arc  forcing  the  pulse  algorithm  to  explore  paths  that  do 
not  traverse  arc  (i,  j).  This  strategy  yields  a  diverse  sample  of  s-t  paths,  which  is  desirable  in  our 


backward  sampling  framework.  Finally,  we  stop  the  sampling  procedure  once  a  maximum  sample 
size  limit  is  reached  or  once  a  time  limit  is  exceeded. 


We  formulate  the  restricted  problem  <2(w,  jP)  as  a  MIP.  Let  Vk  be  the  set  of  arcs  corresponding  to 
the  kth  path  in  sample  y,  and  let  c( Vk)  denote  its  cost.  We  formulate  Q(w,  JP)  as  follows: 


max  z 

(85) 

s.t.  z  <  c(Vk)  +  ^  dijXij,  VVk  G  y , 

(86) 

(i,j)evk 

x  G  X(w). 

(87) 

The  objective  function  (85)  maximizes  z,  which  is  constrained  by  (86)  to  be  no  more  than  the  least 
cost  path  in  y,  after  considering  delays  caused  by  arc  interdiction.  Finally,  constraints  (87)  ensure 
that  we  only  consider  feasible  attacks  in  X  (w). 

Observe  that  if  our  algorithm  generates  an  attack  x  G  X  (w)  having  a  perceived  damage  greater 
than  z,  then  z  cannot  be  improved  in  the  current  iteration.  In  this  case,  our  algorithm  does  not 
utilize  the  precise  perceived  damage  value  (beyond  establishing  that  it  exceeds  z).  It  is  thus  not 
necessary  to  optimize  model  (85)— (87)  if  we  have  proven  that  its  objective  exceeds  z,  and  so  we 
add  the  objective  target  constraint  z  <  z  +  5,  for  a  small  constant  <5  >  0,  to  model  (85)— (87).  This 
ensures  that  any  attack  x  G  X(w)  with  perceived  damage  strictly  greater  than  z  is  sufficient  to 
allow  the  overall  algorithm  to  continue,  even  though  x  may  not  optimize  Q(w.  jp). 

Furthermore,  because  the  x-variables  are  binary-valued  and  djj  >  0,  V(i,  j)  G  A,  the  addition  of 
the  objective  target  constraint  allows  us  to  revise  (86)  as  follows,  where  (•)+  =  max{0,  •}: 

z<c(Vk)+  min {dij^z  +  S-ciV^jxij,  NVk  G  j>.  (88) 

( i,j)evk 

Constraints  (88)  are  at  least  as  tight  as  (86).  (Note  that  (88)  corresponding  to  some  Vk  may  persist 
in  our  interdiction  model  for  a  few  iterations  after  z  +  5  <  ciVk).  We  therefore  require  the 
coefficients  of  the  x-variables  to  be  nonnegative  in  order  to  ensure  the  validity  of  (88).) 


Capacitated  Lot  Sizing  Interdiction  Problem  with  Fortification.  The  capacitated  lot  sizing 
problem  (CLSP)  is  a  well-known  NP-hard  problem  in  which  a  facility  manufactures  a  single  prod¬ 
uct  to  satisfy  a  known  demand  over  a  finite  planning  horizon  subject  to  production  capacity  con¬ 
straints.  In  the  CLSIF  production  capacity  at  any  time  period  could  be  lost  (e.g.,  due  to  machine 
failures).  The  system  operator  can  ensure  that  capacity  is  protected  against  loss  for  some  time  pe¬ 
riods  (e.g.,  by  performing  preventive  maintenance).  In  this  context,  an  “attack”  is  not  necessarily 
due  to  a  malicious  adversary,  but  represents  some  bounded  worst-case  scenario  on  capacity  loss. 

Formally,  we  define  the  CLSIF  as  the  problem  of  finding  a  subset  of  time  periods  to  fortify,  in  order 
to  minimize  the  total  cost  resulting  from  a  worst-case  attack  that  disables  production  capacity  on 
some  of  the  unprotected  time  periods.  Let  T  be  the  set  of  time  periods  in  the  planning  horizon.  For 
each  time  period  t  G  T,  let  dt  be  the  demand,  Ct  be  the  production  capacity,  and  let  ct,  ft,  ht,  and 


qt  be  the  production,  setup,  holding,  and  shortage  cost,  respectively.  All  parameters  are  assumed 
to  be  nonnegative. 

Let  w  G  W  be  the  fortification  decision  variables  and  x  G  X  (w)  be  the  attack  decision  variables, 
where  W  =  {w  :  eTw  <  0.  w  G  {0,  l}lrl }  establishes  the  defender’s  budget  and  ensures  that  the 
fortification  variables  are  binary,  and  X  (w)  =  {x  :  eTx  <  B,  xt  <  1  —  wt  Vf  G  T,  x  G  {0, 1}ITI } 
ensures  that  a  maximum  of  B  unprotected  time  periods  are  attacked,  and  forces  the  attacker  vari¬ 
ables  to  be  binary.  Finally,  let  y,  v,  I,  and  s  be  the  third-stage  decision  variables  modeling  produc¬ 
tion,  setup,  inventory,  and  shortage,  respectively.  The  CLSIF  can  be  formally  stated  as: 


nun  max  mm  }  ctyt  +  ftvt  +  htIt  +  qtSt 

wetVxeA’(w)  z— ' 

iST 

(89) 

S.t.  I0  =  y0  +  So  -  do, 

(90) 

It  —  h- 1  +  lit  +  st  —  dt, 

Vf  e  T\{ 0}, 

(91) 

Vt  <  CtVt, 

Vf  gT, 

(92) 

Vt<  1  -  Xt, 

Vf  gT, 

(93) 

Vt,  h,  st  >  0, 

Vf  gT, 

(94) 

vt  G  (0, 1}, 

vf  g  r. 

(95) 

The  objective  function  (89)  minimizes  the  total  cost  after  interdiction.  Constraints  (90)— (9 1 )  are 
inventory  constraints,  constraints  (92)  enforce  production  capacity  limits,  and  constraints  (93)  for¬ 
bid  production  on  interdicted  time  periods.  Constraints  (94)  and  (95)  place  bounds  and  logical 
restrictions  on  the  decision  variables. 


In  the  following  we  discuss  the  three  components  required  for  solving  the  CLSIF:  a  sampling 
scheme,  an  approach  for  solving  two-level  CLSP  interdiction  problems  restricted  over  a  sample  of 
third-stage  solutions,  and  a  method  to  solve  third-stage  CLSP  problems. 

Let  S  denote  a  production  plan  (third-stage  recourse  solution)  that  specifies  values  for  y,  v,  I,  and 
s.  To  obtain  a  sample  of  production  plans,  we  propose  a  simple  random  search  that  iteratively 
generates  a  random  attack  plan  xr,  and  solves  a  MIP  to  compute  the  optimal  recourse  response 
given  xr.  In  particular,  xr  interdicts  K  time  periods  randomly  selected  among  (0, . . . ,  \T\}.  We 
then  solve  the  following  MIP  given  xr: 


min 

(y,v,I,s)ey(xr) 


CtUt  +  ftvt  +  htIt  +  qtSt, 

teT 


(96) 


where  y(xr)  is  the  third-stage  feasible  region  defined  by  inserting  xr  in  constraints  (90)-(95). 

Let  production  plan  S*  =  (y*,  v*,  I*,  s*}  be  an  optimal  solution  to  the  MIP  given  an  attack  plan 
xr,  and  let  c(S*)  denote  its  cost.  If  c(S*)  <  z,  then  we  add  S*  to  the  sample,  and  otherwise 
we  discard  S*.  We  repeat  this  procedure  for  a  prescribed  number  of  iterations  (regardless  of  how 
many  production  plans  are  added  to  the  sample).  Note  that  the  repeated  solution  of  MIPs  in  the 
sampling  phase  of  this  algorithm  may  ultimately  be  too  computationally  intensive  to  justify  its  use. 
We  will  demonstrate  that  the  solution  of  MIPs  in  this  phase  is  justified.  However,  an  alternative  to 
this  scheme  would  simply  generate  heuristic  recourse  solutions  in  response  to  randomly  sampled 


attacks.  The  tradeoff  thus  involves  the  quality  of  sampled  solutions  (where  higher  quality  samples 
tend  to  speed  overall  convergence)  versus  the  time  required  to  generate  them. 

As  in  the  SPIF,  we  formulate  the  restricted  problem  Q(w,  jP)  as  a  MIP.  Let  Sk  =  (yfc,  vfc,  Ifc,  sfc} 
denote  production  plan  k  in  y  and  T ( Sk )  =  {t  G  T  \  yk  >  0}  be  the  set  of  time  periods  in  which 
plan  Sk  produces  a  positive  amount  of  items.  We  formulate  Q(w,  y)  analogously  to  (85)-(87): 


max  z 

(97) 

s.t.  z < C(sk )  +  Yl  Mtx*  ysk  e y> 

(98) 

teT(Sk) 

x  G  A’(w). 

(99) 

We  use  a  suitably  large  cost  Mk  to  penalize  attacked  production  plans.  To  determine  this  cost,  we 
decompose  yk  into  values  akt, ... ,  a|jr,,  Vf  G  T,  where  ak}  denotes  the  amount  produced  at  period 
t  that  satisfies  demand  at  period  j,  for  :i  >  t.  One  possible  way  of  adjusting  a  solution  if  an  attack 
occurs  at  period  t  is  to  simply  retain  the  previous  solution,  but  with  yk  =  0.  As  a  result,  there  will 
be  a  savings  of  ft  +  ctyk  due  to  eliminated  fixed  and  variable  costs,  plus  any  holding  costs  that 
were  incurred  due  to  production  in  period  t.  However,  without  adjusting  production  at  any  other 
period,  we  would  incur  additional  shortage  costs  of  qjakj  for  each  3>t.  Accordingly,  we  define 
the  cost  penalty  for  any  production  plan  Sk  at  time  period  t  as 

M>  =  (  E  iA ) - /< - c<yt -  EE h‘a‘i] ■  (100) 

VjeT :]>t  /  \jeT:j>t  l=t  ) 

Proposition  14  shows  that  (98)  remains  valid  when  Mk  is  defined  as  in  (100). 


Proposition  14  Consider  any  x  e  X  and  let  S*  G  jf'fx)  be  its  corresponding  optimal  recourse 
response.  For  any  production  plan  Sk,  we  have  that  c(Sk )  +  Mkxt  >  c(S*),  where  the 


M -values  are  defined  in  (100). 


ieT(5fe) 


We  use  the  objective  target  strategy  introduced  for  the  SPIF.  Following  the  same  logic,  we  add  the 
constraint  z  <  z  +  5  to  model  (97)— (99),  which  allows  us  to  tighten  (98)  as  follows: 

z  <  c(5fc)  +  min {Mk,  (z  +  8  -  c(Sk))+}xt,  VSk  G  j>.  (101) 

t.eT{Sk ) 

Calculating  the  real  damage  of  an  attack  x  requires  solving  a  CLSP  in  which  the  production  ca¬ 
pacity  for  time  periods  attacked  by  x  is  set  to  zero.  One  simple  approach  solves  the  classical  MIP 
model  for  the  CLSP  given  attack  plan  x  stated  in  (96).  Because  the  backward  sampling  framework 
does  not  require  a  specific  solution  method  for  the  third-stage  problem,  we  could  employ  any  of 
the  well-established  methods  for  solving  the  CLSP  including  the  standard  dynamic  programming 
approach  in  which  inventory  at  time  t  is  used  as  state  variable. 


Computational  Experiments.  This  section  presents  computational  results  on  the  SPIF  (for  the 
CLSIF,  see  Lozano  and  Smith  (2015)).  We  assess  the  performance  of  our  algorithm  on  the  SPIF 
using  randomly  generated  grid  networks  and  real  road  networks.  We  coded  our  algorithm  in  Java, 
using  Eclipse  SDK  version  4.4.1,  and  executed  the  experiments  on  a  machine  having  an  Intel  Core 
i7-3537U  CPU  (two  cores)  running  at  2.00  GHz  with  2  GB  of  RAM  allocated  to  the  Java  Virtual 
Machine  memory  heap  on  Windows  8.  We  impose  a  time  limit  of  four  hours  (14,400s)  and  solve 
all  mathematical  optimization  problems  using  Gurobi  5.6.  All  instances  and  source  code  used  in 
this  section  are  available  from  the  authors. 

We  generate  directed  grid  networks  having  a  source  node  s,  a  sink  node  t,  and  m  x  n  nodes  arranged 
in  a  grid  of  m  rows  and  n  columns.  There  exists  an  arc  from  s  to  every  node  in  the  first  column 
and  an  arc  from  every  node  in  the  last  column  to  t.  Also,  arcs  exist  from  each  node  in  grid  row  r 
and  column  c  to  (existing)  nodes  in  positions  (r  +  1,  c),  (r  —  1,  c),  (r,  c  +  1),  (r  +  1,  c  +  1),  and 
(r  —  1,  c  +  1)  provided  that  these  are  not  vertical  arcs  in  the  first  or  last  columns. 

We  build  networks  with  sizes  ranging  from  10  x  10  to  60  x  60.  For  each  network  size  we  explore 
different  (cost,  delay)  configurations  in  which  arc  costs  (delays)  are  random  integers  uniformly 
distributed  between  [1,  c]  ([1,  d\),  where  c  (d)  denotes  the  maximum  cost  (delay).  We  explore  the 
following  (c,d)  configurations:  (10,5),  (10,10),  (10,20),  (100,50),  (100,100),  and  (100,200). 
For  a  fixed  network  size  and  (c,  d )  configuration,  we  generate  ten  instances  with  different  random 
arc  attributes  for  a  total  of  360  =  6  x  6  x  10  different  instances.  For  each  instance  we  solve  six 
problems  with  different  Q  values  in  (3, 4,  5,  7}  and  B  values  in  (3, 4, 5},  for  a  total  of  2160  = 
360  x  6  experiments.  After  tuning  the  algorithm  parameters,  we  set  the  maximum  sample  size  to 
100,  the  sampling  time  limit  to  1  second,  the  arc-usage  upper  limit  to  20,  threshold  e  to  0.1,  and  5 
to  1. 

Tables  1  and  2  show  the  computational  results  for  medium-  and  large-sized  grid  networks,  respec¬ 
tively.  The  first  five  columns  show  grid  size,  number  of  nodes  and  arcs,  and  the  defender’s  and 
attacker’s  budget  ( Q  and  B ),  respectively.  For  each  of  the  six  (c,  d )  configurations,  the  tables  de¬ 
pict  the  average  CPU  time  obtained  over  ten  runs  (Avg)  and  the  largest  CPU  time  obtained  over 
those  runs  (Max). 

Table  1  shows  that  on  average,  our  algorithm  finds  optimal  solutions  for  the  10  x  10  and  20  x  20 
networks  in  just  a  few  seconds,  and  requires  less  than  one  minute  to  solve  the  30  x  30  networks, 
which  have  more  than  4000  arcs.  The  maximum  execution  times  are  close  to  the  average  times; 
even  in  the  worst  case  (30  x  30  grids  with  Q  =  7,  B  =  5,  and  (c,  d)  =  (10,  20)),  the  algorithm 
terminates  in  just  over  two  minutes. 


Table  1:  Computational  time  in  CPU  seconds  for  solving  the  SPIF  over  medium-size  grid  networks 


Cost-delay  configuration  (c,  d) 


Instance 

Nodes 

Arcs 

Q 

B 

(10,5) 

(10, 10) 

(10,20) 

(100,50) 

(100,100) 

(100,  200) 

Avg 

Max 

Avg 

Max 

Avg 

Max 

Avg 

Max 

Avg 

Max 

Avg 

Max 

10  x  10 

102 

416 

3 

3 

0.1 

0.3 

0.1 

0.2 

0.1 

0.2 

0.1 

0.2 

0.1 

0.3 

0.1 

0.2 

4 

3 

0.1 

0.1 

0.1 

0.2 

0.1 

0.2 

0.1 

0.2 

0.1 

0.2 

0.2 

0.2 

3 

4 

0.1 

0.2 

0.2 

0.5 

0.2 

0.5 

0.3 

0.5 

0.3 

0.7 

0.3 

0.7 

5 

4 

0.2 

0.3 

0.3 

0.5 

0.3 

0.6 

0.3 

0.4 

0.4 

0.7 

0.4 

0.8 

4 

5 

0.3 

0.4 

0.5 

1.1 

0.8 

2.2 

0.6 

1.5 

1.0 

2.9 

1.1 

2.8 

7 

5 

0.7 

1.0 

0.9 

1.6 

1.0 

2.3 

0.8 

1.2 

1.3 

2.9 

1.3 

1.9 

20  x  20 

402 

1826 

3 

3 

0.3 

0.9 

0.5 

1.9 

0.6 

3.3 

0.7 

2.0 

0.7 

1.3 

0.8 

2.0 

4 

3 

0.4 

1.2 

0.6 

2.2 

0.8 

4.3 

0.9 

2.3 

0.8 

1.6 

0.9 

2.0 

3 

4 

0.6 

1.5 

1.1 

3.2 

1.1 

5.1 

2.2 

5.1 

2.4 

5.9 

2.4 

8.0 

5 

4 

1.0 

2.7 

2.2 

10.8 

2.2 

12.8 

2.1 

4.4 

2.9 

6.1 

2.9 

9.1 

4 

5 

1.8 

5.6 

4.2 

18.2 

4.1 

16.8 

6.5 

16.1 

8.3 

22.4 

9.7 

33.4 

7 

5 

3.6 

10.8 

5.7 

13.1 

6.7 

28.3 

7.3 

13.3 

9.8 

21.3 

12.5 

36.8 

30  x  30 

902 

4236 

3 

3 

0.8 

1.1 

1.2 

3.6 

1.9 

7.3 

1.8 

7.5 

2.0 

3.9 

2.3 

6.0 

4 

3 

0.9 

1.2 

1.4 

3.7 

2.0 

6.9 

2.3 

11.2 

2.6 

6.1 

2.4 

5.7 

3 

4 

1.6 

2.6 

3.8 

14.9 

6.0 

25.6 

4.4 

15.0 

5.5 

13.3 

6.3 

15.5 

5 

4 

2.7 

4.1 

6.1 

27.4 

8.1 

36.4 

6.2 

21.5 

10.0 

31.0 

10.2 

36.9 

4 

5 

5.2 

11.8 

15.9 

77.2 

23.2 

94.8 

15.9 

60.2 

24.2 

61.1 

27.1 

73.2 

7 

5 

11.7 

22.7 

26.7 

108.2 

30.1 

131.7 

21.9 

62.7 

35.8 

101.1 

36.7 

91.2 

Table  2:  Computational  time  in  CPU  seconds  for  solving  the  SPIF  over  large-size  grid  networks 
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Table  2  shows  that,  on  average,  the  algorithm  terminates  in  less  than  six  minutes  for  the  40  x  40 
networks,  in  less  than  nine  minutes  for  the  50  x  50  networks,  and  in  less  than  29  minutes  for  the 
60  x  60  networks,  for  any  combination  of  c,  d,  Q,  and  B  examined.  The  maximum  execution 
times  are  larger  relative  to  the  average  CPU  times  on  these  instances,  and  some  of  them  require 
roughly  four  hours  of  computational  time  over  the  60  x  60  networks.  This  behavior  is  expected, 
considering  that  these  networks  have  more  than  3000  nodes  and  17,000  arcs.  Table  2  suggests  that 
the  instances  become  more  difficult  as  d  grows  larger  relative  to  c  and  when  the  cost  (delay)  values 
increase  (implying  that  (c,  d)  =  (100,  200)  are  typically  the  most  challenging  instances).  Finally, 
an  increase  in  the  attacker’s  budget  tends  to  have  a  greater  impact  on  the  computation  time  than  an 
increase  in  the  defender’s  budget. 

We  compare  our  approach  (Sampling)  to  the  current  state-of-the-art  algorithm  by  Cappanera  and 
Scaparra  (201 1)  over  medium-sized  instances,  who  graciously  provided  their  code  for  the  purposes 
of  this  comparison.  Table  3  shows  the  results  for  this  comparison.  Here,  the  “Avg”  column  depicts 
the  average  CPU  time  in  seconds,  computed  only  among  the  instances  solved  within  the  time  limit. 
As  before,  “Max”  refers  to  maximum  CPU  seconds  out  of  the  60  instances  solved  for  the  row,  and 
“#  solved”  gives  the  number  of  instances  solved  within  the  four-hour  time  limit. 

Table  3:  Comparing  the  backward  sampling  algorithm  to  the  state-of-the-art  algorithm  for  SPIF 


Instance 

Nodes 

Arcs 

Q 

B 

Sampling 

SPI 

Avg 

Max  #  solved 

Avg 

Max 

#  solved 

3 

3 

0.1 

0.3 

60 

1.9 

4.6 

60 

10  x  10 

102 

416 

5 

4 

0.3 

0.8 

60 

30.9 

162.8 

60 

4 

5 

0.7 

2.9 

60 

67.5 

284.2 

60 

3 

3 

0.6 

3.3 

60 

26.7 

305.1 

60 

20  x  20 

402 

1,826 

5 

4 

2.2 

12.8 

60 

1128.4 

7723.4 

60 

4 

5 

5.8 

33.4 

60 

2495.2 

>14,400 

56 

3 

3 

1.7 

7.5 

60 

766.9 

12,728.8 

60 

30  x  30 

902 

4,236 

5 

4 

7.2 

36.9 

60 

4857.3 

>14,400 

45 

4 

5 

18.6 

94.8 

60 

4256.8 

>14,400 

26 

Table  3  shows  that  our  algorithm  compares  favorably  to  SPI,  consistently  reducing  computational 
time  by  more  than  two  orders  of  magnitude  both  in  terms  of  average  and  maximum  execution 
times,  for  any  combination  of  (Q,  B )  examined.  Moreover,  our  sampling  algorithm  solves  all 
instances  within  the  time  limit  while  SPI  solves  56  instances  when  (Q,  B )  =  (4,  5)  on  the  20  x  20 
networks,  45  instances  when  ( Q ,  B )  =  (5, 4)  on  the  30  x  30  networks,  and  26  instances  when 
(Qi  B)  =  (4,  5). 

We  now  use  the  road  networks  from  Washington  (DC),  Rhode  Island  (RI),  and  New  Jersey  (NJ) 
presented  by  Raith  (2009).  These  networks  range  from  9559  nodes  and  39,377  arcs  to  330,386 
nodes  and  1,202,458  arcs.  For  each  road  network,  there  are  nine  randomly  selected  s-t  pairs.  We 
define  ctj  as  the  arc  distance  and  set  drJ  =  10,000,  V(z ,  .7  )  e  A.  For  each  network  and  s-t  pair  we 
explore  six  budget  configurations  for  a  total  of  162  =  3x9x6  experiments.  Table  4  shows  the 
results  for  these  experiments. 

Table  4  shows  that  the  algorithm  solves  all  DC  instances  to  optimality  within  the  time  limit.  The 
average  CPU  time  for  these  instances  is  less  than  nine  minutes  and  the  worst  execution  time  is 
well  under  one  hour.  On  the  RI  network,  the  algorithm  solves  all  instances  with  B  <  4  and  solves 


Table  4:  Computational  time  in  CPU  seconds  for  solving  the  SPIF  over  road  networks 


Instance 

Nodes 

Arcs 

Q 

B 

Avg 

Max 

#  solved 

DC 

9559 

39,377 

3 

3 

45.8 

124.9 

9 

4 

3 

50.6 

127.1 

9 

3 

4 

92.2 

402.9 

9 

5 

4 

103.0 

374.8 

9 

4 

5 

492.8 

2829.5 

9 

7 

5 

450.1 

1906.4 

9 

RI 

53,658 

192,084 

3 

3 

284.5 

756.0 

9 

4 

3 

295.6 

817.3 

9 

3 

4 

800.7 

4925.1 

9 

5 

4 

946.2 

5974.9 

9 

4 

5 

560.1 

>14,400 

8 

7 

5 

754.0 

>14,400 

8 

NJ 

330,386 

1,202,458 

3 

3 

6743.8 

10,551.9 

9 

4 

3 

6345.8 

>14,400 

8 

3 

4 

6526.8 

>14,400 

8 

5 

4 

6964.3 

>14,400 

8 

4 

5 

7354.6 

>14,400 

8 

7 

5 

8452.6 

>14,400 

8 

all  but  one  instance  each  when  (Q,  B )  =  (4,  5)  and  (7,  5).  Average  CPU  times  are  less  than  15 
minutes  among  the  instances  solved  to  optimality  within  the  time  limit,  for  any  choice  of  (Q,  B). 
On  the  NJ  network,  the  algorithm  solves  all  instances  with  Q  =  B  =  3  and  solves  all  but  one 
instance  in  each  set  corresponding  to  the  other  {().  B )  combinations.  Average  times  are  roughly 
two  hours  among  the  instances  solved  to  optimality. 


9  Defender- Attacker  Influence  Spread  Games 


In  the  study  of  Hemmati,  Smith,  and  Thai  (2014),  we  consider  a  network  whose  nodes  can  be 
influenced  somehow  by  competing  agents.  These  networks  may  model  social  or  geographical 
interactions  among  entities,  and  influence  can  represent  the  spread  of  rumors,  infections,  or  other 
types  of  transmissions  over  the  nodes.  A  key  question  related  to  competition  over  such  networks 
seeks  to  identify  vital  nodes  in  the  network  with  the  aim  of  protecting  them  from  being  the  source 
of  influence  propagation  from  competing  agents. 

We  consider  a  scenario  in  which  two  players,  a  defender  and  an  attacker,  compete  on  a  directed 
network  G ( V,  A),  where  V  is  the  set  of  nodes  and  A  is  the  set  of  arcs.  Initially,  the  defender  owns 
every  node  in  the  network,  and  can  protect  a  subset  of  nodes  against  an  impending  action  by  the 
attacker.  The  attacker  then  acts,  with  full  knowledge  of  the  defender’s  action,  to  capture  a  set  of 
unprotected  nodes.  For  consistency  with  prior  related  studies,  we  say  that  captured  nodes  have 
been  influenced  by  the  attacker.  This  initial  action  takes  place  at  time  0,  and  the  game  continues 
for  T  (discrete)  time  periods  according  to  the  following  rules. 


1.  An  influenced  node  remains  influenced  for  the  remainder  of  the  time  horizon. 

2.  A  node  that  was  protected  by  the  defender  cannot  be  influenced  at  any  time. 


(^)  Uninfluenced  node  Influenced  node 


(b)f=1 


(c)f=2 


Figure  16:  An  instance  with  Q  =  3  and  T  =  2,  in  the  absence  of  protected  nodes. 


3.  Consider  an  unprotected  node  j  G  V  that  is  not  influenced  at  time  t  G  {0, . . . ,  T  —  1}.  Then 
node  j  G  V  becomes  influenced  at  time  t  +  1  if  and  only  if  there  are  some  0  nodes  i  G  V  such 
that  i  is  influenced  at  time  t,  and  (i,j)  G  A. 

4.  The  attacker  earns  a  reward  of  r\  if  node  i  is  influenced  at  time  t  (but  not  at  time  t  —  1,  if  t  >  1). 

The  goal  of  the  defender  is  to  minimize  the  maximum  sum  of  rewards  that  the  attacker  can  earn 
(e.g.,  minimizing  the  maximum  amount  of  damage  that  the  attacker  could  possibly  inflict  on  the 
defender’s  network). 

Figures  16  and  17  illustrate  a  problem  instance  in  which  Q  —  3  and  T  =  2.  The  r- values  are 
stated  for  each  time  period  next  to  each  node.  Consider  the  case  in  which  no  nodes  are  initially 
protected,  and  the  attacker  influences  nodes  1,  2,  6,  8,  and  9  at  t  =  0  (Figure  16a).  As  the  result  of 
this  action,  nodes  3  and  5  become  influenced  at  t  —  1,  because  nodes  1,  2,  and  8  are  influenced  at 
t  —  0  (Figure  16b).  Nodes  4  and  7  become  influenced  at  /,  =  2  (Figure  16c).  Hence,  the  attacker 
earns  a  reward  of  480.  Next,  suppose  that  the  defender  protects  nodes  6  and  9.  Then  an  optimal 
response  from  the  attacker  is  to  influence  nodes  1,  2,  and  8  (Figure  17a).  Although  nodes  3  and  5 
become  influenced  at  t  =  1  (Figure  17b),  only  node  7  will  be  influenced  at  t  =  2  (Figure  17c).  In 
this  case,  the  attacker’s  reward  reduces  to  310. 

For  each  node  i  G  V,  define  the  set  of  incoming  neighbors  of  i  as  V~(i )  =  {j  G  V  :  (j,  i)  G  A}, 
and  the  set  of  outgoing  neighbors  of  i  as  V+{i)  =  {j  G  V  :  (i,j)  G  A}.  Let  T  =  {1, . . . ,  T}  be 
the  set  of  time  periods.  Recall  that  an  unprotected  node  *  G  V  that  is  not  influenced  at  time  t  —  1 
becomes  influenced  at  time  t  G  T  if  at  least  Q  nodes  in  V~{i )  are  influenced  at  time  t  —  1,  where 
we  refer  to  Q  as  the  threshold  influence  parameter.  Also,  recall  that  the  attacker  earns  a  reward  of 
r\  if  node  ?’  G  F  is  influenced  at  time  t  G  T  U  {0}  for  the  first  time,  where  r°  >  •  •  •  >  rf.  There 
exists  a  cost  of  q,  i  G  V,  for  the  attacker  to  influence  node  i  at  time  zero.  Similarly,  the  defender 


Figure  17:  An  instance  with  Q  —  3  and  T  —  2,  with  nodes  6  and  9  protected  by  the  defender. 


incurs  a  cost  of  bi:  i  E  V,  to  protect  node  i.  In  our  model,  the  defender  (attacker)  has  a  budget  of 
B  (D)  to  protect  (initially  influence)  nodes. 

In  order  to  formulate  this  problem,  we  first  define  two  sets  of  binary  decision  variables  x% ,  i  E  V, 
and  y ’’ .  In  our  model,  ay  =  1  if  the  defender  protects  node  i  E  V,  and  xt  =  0  otherwise.  Also, 
?/’  =  1  if  node  i  E  17  is  influenced  by  the  attacker  at  time  zero,  and  ;//’  =  0  otherwise.  Additionally, 
we  introduce  binary  decision  variables  y\  =  1,  t  E  T,  if  node  i  E  V  is  influenced  at  time  t,  and 
y\  =  0  otherwise.  Note  that  we  have  separated  //’-variables  from  //-variables  to  emphasize  the 
difference  between  influence  at  t  —  0  and  t  >  0,  because  the  latter  results  from  the  spread  of 
influence.  The  defender’s  problem  can  be  formulated  as  follows. 


min  z(x ) 

(102a) 

s.t.  bT x  <  B 

(102b) 

Xi  E  (0, 1} 

Vi  e  v. ; 

(102c) 

where  z(x)  is  the  optimal  objective  value  of  the  attacker’s  problem,  which  can  be  computed  by 

solving  the  following  integer  program  given  some  fixed  value  of  x  =  x: 

ATTl(a:)  :  z(x)  =  max  ^  |  r/;yJ°  +  y~~V-( 

-  r1)) 

(103a) 

iev  V  t= l 

/ 

s.t.  y\<  1  —  Xi 

Vi  e  17,  t  E  T  u  {0} 

(103b) 

Qy\<QvU  V 

ylfl  Vi  g  V,  t  eT 

(103c) 

jev~(i 

) 

cTy°  <  D 

(103d) 

y^{  0,1} 

Vi  g  1/ 

(103e) 

y\  e  {o,  1} 

Vi  G  17,  t  E  T. 

(103f) 

The  objective  function  (102a)  reflects  the  defender’s  goal  of  minimizing  the  maximum  reward 
earned  by  the  attacker  (computed  by  solving  (103)).  The  defender’s  budget  limit  and  the  binari- 
ness  of  the  ^-variables  are  enforced  by  constraints  (102b)  and  (102c),  respectively.  The  objective 
function  (103a)  represents  the  attacker’s  reward,  noting  that  yf  =  1  if  node  i  G  V  is  initially  influ¬ 
enced,  and  yj  —  y'f  '1  =  1  if  node  i  G  V  is  influenced  for  the  first  time  at  time  t  G  T.  Constraint 
(103b)  implies  that  a  protected  node  can  never  be  influenced  by  the  attacker.  Constraints  (103c) 
governs  the  spread  of  influence:  If  node  i  G  V  is  initially  influenced,  then  the  right-hand-side 
(RHS)  of  constraints  (103c)  will  be  at  least  0  for  all  t  &  T,  implying  that  node  i  will  remain  in¬ 
fluenced  at  all  time  periods.  Now,  suppose  that  node  i  G  V  is  not  initially  influenced,  and  consider 
constraint  (103c)  for  node  i  and  time  t  G  T.  The  constraint  implies  that  node  i  can  be  influenced 
at  time  t  if  and  only  if  Yhjev~(i)  -I'f '  —  Q>  ’-c-’  if  an(i  oniy  if  at  least  Q  nodes  adjacent  to  node  i 
are  influenced  at  time  t  —  1.  Note  that  for  any  node-time  pair  i  G  V  and  t  &T,  yj  is  present  with  a 
nonnegative  coefficient  in  the  objective  function  (due  to  nonincreasing  values  for  node  i’s  rewards 
over  time).  Therefore,  there  exists  an  optimal  solution  in  which  yj  —  1  if  and  only  if  either  node  i 
is  initially  influenced,  or  at  least  Q  nodes  adjacent  to  node  i  are  influenced  at  time  t  —  1.  Finally, 
constraint  (103d)  enforces  the  attacker’s  budget  limit,  and  constraints  (103e)  and  (103f)  restrict  the 
y-variables  to  be  binary-valued. 

In  the  rest  of  this  discussion,  we  define  X  =  {x  G  {0,1}|V|  :  bTx  <  B}  as  the  set  of  possible 
actions  for  the  defender.  Given  x  G  X,  we  also  define  Y(x)  =  {y°  G  (0,  l}^  :  cTy°  <  D ,  y°  < 
1  —  Xi,  Vi  G  V}  as  the  set  of  available  actions  for  the  attacker  at  time  zero  when  the  defender 
chooses  x. 

We  may  also  wish  to  consider  the  case  in  which  the  influence  threshold  value  depends  on  the 
node  being  influenced,  and  so  node  i  becomes  influenced  at  time  t  if  some  Qt  nodes  in  V~(i) 
are  influenced  at  time  t  —  1.  This  case  can  be  transformed  to  the  case  in  which  all  nodes  have  a 
common  threshold  value,  Q.  To  see  this,  let  Q  =  ma xieV{Qi}-  Create  a  set  of  Q  dummy  nodes 
that  are  impossible  to  protect  and  free  for  the  attacker  to  initially  influence,  and  let  the  reward  for 
influencing  these  nodes  equal  0  at  all  time  periods.  For  each  i  G  V,  create  an  arc  from  Q  —  Qi 
of  the  dummy  nodes  to  node  i.  Because  an  optimal  solution  exists  in  which  all  of  these  dummy 
nodes  would  be  initially  influenced,  only  Qi  more  nodes  in  V~(i)  from  the  original  graph  must 
be  influenced  in  order  to  influence  node  i,  as  desired.  Hence,  for  simplicity,  we  use  the  common 
threshold  value  of  Q  in  this  paper.  ■ 

We  finish  this  section  by  observing  that  the  attacker’s  problem  is  strongly  NP-hard.  To  see  this, 
we  sketch  a  (polynomial)  reduction  from  the  dominating  set  problem  to  a  variant  of  the  attacker’s 
problem.  In  the  dominating  set  problem,  we  seek  a  subset  D  of  nodes  in  an  undirected  graph 
G(V,  E)  such  that  each  node  in  V\D  is  adjacent  to  at  least  one  node  in  D,  and  such  that  \D\  <  5 
for  some  given  positive  integer  5.  Now,  consider  the  attacker’s  problem  with  Q  —  1  and  T  —  1. 
Let  the  attacker’s  problem  network  G(V,  A)  consist  of  the  same  node  set  as  in  the  dominating  set 
instance,  and  let  A  contain  two  directed  arcs,  (i,j)  and  for  each  (i,j)  G  E.  Also,  define 
B  =  5  and  b,  =  rf  =  r]  —  1,  Vi  G  V.  There  exists  a  dominating  set  having  5  nodes  if  and  only 
if  there  exists  a  solution  to  the  attacker’s  problem  with  reward  |Vj.  Hence,  the  attacker’s  problem 
is  strongly  NP-hard.  Moreover,  the  defender’s  problem  is  also  NP-hard,  because  evaluating  z(x) 
cannot  be  done  in  polynomial  time  unless  P  =  NP. 


Exact  Solution  Method.  We  now  provide  a  cutting-plane  scheme  to  solve  the  problem  consid¬ 
ered  here.  The  inherent  difficulty  in  solving  model  (102)  is  due  to  the  nonconvexity  of  the  attacker’s 
problem,  which  prohibits  us  from  readily  obtaining  a  strong  (minimization)  dual  to  model  (103) 
and  employing  standard  interdiction  models.  In  order  to  devise  a  cutting-plane  algorithm,  we  start 
by  proposing  a  reformulation  of  the  foregoing  problem. 

We  reformulate  (102)  by  introducing  a  variable  z,  and  minimizing  z  subject  to  the  restriction  that 
x  G  X  and  z  >  z(x).  We  refer  to  a  pair  (x,z)  as  a  two- stage  feasible  solution  if  x  G  X  and 
z  >  z(x).  Defining  Q  as  the  set  of  all  two-stage  feasible  solutions,  we  obtain  the  following 
reformulation  for  the  defender’s  problem: 


DEF  :  min  z 

s.t.  x  G  X 
(x,  z )  G  O. 


(104a) 

(104b) 

(104c) 


Note  that  an  optimal  solution  (x*,  z*)  to  (104)  satisfies  z*  =  z(x*),  because  (104)  is  a  minimization 
program. 

Let  Cl  D  Q  be  a  feasible  region  induced  by  a  set  of  affine  inequalities,  and  define  DEF-R  as  the 
relaxation  of  (104)  obtained  by  replacing  0  with  Q.  The  motivation  for  introducing  DEF-R  stems 
from  the  fact  that  exponentially  many  inequalities  may  be  required  for  the  explicit  definition  of  Q. 
Hence,  our  approach  starts  with  an  initial  0  defined  by  a  small  (polynomial-size)  set  of  inequalities. 
If  an  optimal  solution  (x,  z)  to  DEF-R  is  two-stage  feasible,  then  it  must  be  also  optimal  to  (102), 
because  DEF-R  is  a  relaxation  of  (102).  Otherwise,  we  can  augment  DEF-R  with  a  cutting  plane 
(as  discussed  below)  and  re-solve  DEF-R  in  an  iterative  fashion  until  a  two-stage  feasible  solution 
is  found.  We  start  by  computing  lower  and  upper  bounds  for  the  optimal  objective  value  of  the 
attacker’s  problem. 


Lemma  12  Let  1  <  j  <  \V\,  be  the  node  having  the  jth  largest  reward  at  t  =  0.  Denote  by 
q\  the  largest  integer  such  that  YU<zv'  c,>  —  B,  VV7  —  V  '■  l^'l  —  Qi-  Also,  denote  by  p2  the  largest 
integer  such  that  YhieV'  h  —  B  for  some  V'  C  V  :  \V'\  —  p2-  Define: 


Zvn\n 


min{  |  V  | ,  p2+qi } 

,„0 


i=P2+l 


Hj) ' 


We  have: 


z{x)  >  zn 


\/x  G  X. 


(105) 


The  proof  of  this  and  other  lemmas  are  contained  in  Hemmati  et  al.  (2014). 


Lemma  13  Let  q2  be  the  largest  integer  such  that  YhieV'  c>  —  B  for  some  V'  C  V  :  \V'\  —  q2. 
Given  a  defender’s  decision  vector  x,  an  upper  bound  on  the  attacker’s  optimal  objective  value  is 
obtained  by  solving  the  following  problem. 


[x  =  max 


E 


(1  -  Xi)  (r9y?  +  r](  1  -  y,0)) 


(106a) 


s.t. 


(106b) 


Y1  y°i  -  ^ 

i&V 

0  <  y-  <  1  Vi  G  V  (106c) 

Note  that  problem  (106)  can  be  optimized  in  0(  \V\  log(|V|))  steps  by  sorting  the  (1  —x,;)(rf  —  re¬ 
values  in  nonincreasing  order,  and  setting  yf  =  1  for  each  node  %  G  V  corresponding  to  the 
g2-largest  such  coefficients. 

The  bound  z(x)  <  zmax(x)  is  valid  for  any  x  G  X,  and  so  one  strategy  may  enumerate  several 
candidate  solutions  x  G  X,  compute  zmax(x)  for  each  vector,  and  obtain  the  minimum  such  value 
as  a  valid  upper  bound.  Additionally,  we  can  solve  the  following  optimization  problem. 

An  ax  =  min  zmax(x)  (107  a) 

s.t.  x  G  X.  (107b) 

Observe  that  (107)  is  a  two-stage  program  in  which  the  feasible  region  of  the  inner  problem  is 
independent  of  ^-variables.  This  allows  us  to  state  (107)  as  a  linear  mixed-integer  program  by 
dualizing  the  inner  problem.  Let  a  and  /V,  i  G  V,  be  the  dual  variables  corresponding  to  constraints 
(106b)  and  (106c),  respectively.  We  obtain  the  following  reformulation  of  (107). 


^max  E  rl  +  min  q^cv  +  ^  —  rlxi)  (108a) 

iev  iev 

s.t.  a  +  ft  +  (r°  —  r})xi  >  (r°  —  r])  Vi  G  V  (108b) 

a  >  0  (108c) 

jdi>  0  Vi  G  V  (108d) 

x  G  X.  (108e) 


Note  that  problem  (108)  has  to  be  solved  only  once  in  order  to  obtain  an  upper  bound  for  the 
problem,  and  hence  will  not  likely  represent  a  substantial  portion  of  the  time  required  to  solve  the 
overall  model  we  investigate  here. 

An  alternative  strategy  is  to  heuristically  select  some  x  G  X,  e.g.,  by  using  the  following  greedy 
algorithm.  Initialize  Xi  =  0,  Vi  G  V,  and  set  a  “remaining  budget”  value  B  —  B.  Find  an 
index  i  such  that  rf  is  maximized  over  all  i  G  V  such  that  xr  =  0  and  bt  is  not  more  than  B.  If 
no  such  index  i  exists,  then  set  the  upper  bound  to  zm^(x).  Else,  set  Xi  =  1,  reduce  B  by  bi, 
and  reiterate.  In  our  initial  computational  experiments,  we  compare  the  effectiveness  of  the  exact 
formulation  (108)  versus  the  use  of  this  greedy  algorithm,  and  employ  the  most  effective  one  in 
our  computational  study.  ■ 

Cutting-plane  Algorithm.  We  now  provide  valid  inequalities  for  DEF-R,  and  we  propose  a 
cutting-plane  scheme  for  identifying  an  optimal  solution  to  (102). 

Consider  x  G  X  and  suppose  that  y  =  (y°, . . . ,  yT )  is  optimal  to  ATTl(a;).  We  define  f*,  i  G  V, 
as  the  earliest  time  that  node  i  is  influenced  in  the  solution  y.  We  use  the  convention  t i  =  T  +  1 
if  node  i  G  V  is  never  influenced  by  the  attacker,  and  we  let  rj  + 1  =  0.  Consider  the  vector 


r  =  (ri, . . . ,  T\V\),  and  for  all  i  G  V,  define  RJ  as  the  set  of  all  unprotected  nodes  j  &  V  such  that 
there  exists  a  directed  path  from  node  i  to  node  j  using  t3  or  fewer  arcs  in  A  (and  hence,  i  G  R J). 

Lemma  14  Consider  a  solution  x  G  X  in  which  xt  =  0  for  some  node  i  G  V.  Lety  =  ( y° , . . . ,  yT) 
be  an  optimal  solution  toATTl(x),  with  corresponding  vector  t.  Suppose  that  the  solution  x,  which 
is  identical  to  x  with  the  exception  of  setting  xt  =  1,  is  feasible  to  (102).  Then  we  have: 

z{x )  >  z(x)  —  ^  ry\  (109) 

ieRf 


For  any  given  x  G  X,  define  as  the  set  of  protected  nodes  in  x.  Furthermore,  let  y  = 
(y°, ,  yT)  be  an  optimal  solution  to  ATTl(a;),  and  define  14  as  the  set  of  all  influenced  nodes  in 
solution  y.  We  introduce  our  first  valid  inequality  for  (104)  in  the  next  theorem. 


Theorem  16  Let  (x,  z)  be  an  optimal  solution  to  DEF-R,  and  suppose  that  z  <  z(x).  Let  y  be  an 
optimal  solution  to  ATTl(x),  with  corresponding  vector  T.  The  following  inequality: 


z  >  z(x)  - 

ieVx 


Xi, 


is  valid  to  (104)  and  cuts  ojf(x,  z). 


(HO) 


The  following  cutting -plane  algorithm,  which  we  call  CPA,  is  then  given  as  follows. 


Step  0  (Initialization).  Set  the  upper  bound  UB  =  zmax  and  the  lower  bound  LB  =  zmin.  Let 

1  ■  Z)  ■  X  G  Xj  Z  4  '-min  }  • 

Step  1  (Lower  Bound).  Identify  an  optimal  solution  (x,  z)  to  DEF-R.  Set  LB  =  2,  and  proceed  to 
Step  2. 

Step  2  (Upper  Bound).  Solve  ATTl(af).  If  z(x)  <  UB,  then  set  UB  =  z(x),  and  let  x  be  the 
incumbent  solution  to  (102).  In  either  case,  proceed  to  Step  3. 

Step  3  (Termination/Cut  Routine).  If  LB  =  UB,  then  terminate  with  the  incumbent  solution 
being  optimal.  Otherwise,  add  (110)  to  O,  and  return  to  Step  1. 


At  each  iteration,  CPA  either  terminates  with  an  optimal  solution  in  Step  3,  or  the  identified  solution 
(x,  z)  in  Step  1  will  be  cut  off  by  the  inequality  added  in  Step  3.  Note  that  X  is  a  finite  set,  and  that 
if  some  solution  x'  is  encountered  as  the  optimal  solution  in  Step  1  in  two  different  iterations  k\  and 
k2  of  CPA,  then  LB  =  UB  after  iteration  k2.  This  behavior  is  due  to  the  fact  that  inequality  (110) 
was  added  for  x  —  x'  after  iteration  kp,  hence,  at  iteration  k2,  this  inequality  forces  z  >  z(xr).  As 
a  result,  CPA  converges  to  an  optimal  solution  in  a  finite  number  of  steps. 


Spread  Network  Inequalities 


For  x  G  X,  consider  an  optimal  solution  y  =  (y°, . . . ,  yT ),  and  its  associated  vector  t.  Define 
Vl  =  {i  G  V  :  fi  =  t},  t  G  TU  {0},  and  observe  that  14  =  U*Lo  We  denote  by  G4(I4,  4S)  an 
acyclic  time-expanded  network,  called  the  spread  network ,  with  T+ 1  time  levels.  For  node  i  G  V| 
at  time  t  G  74  there  exist  at  least  Q  nodes  h  such  that  (/i,  i)  G  4  and  t  —  1.  Let  S',  |S"|  =  Q, 
be  any  subset  of  such  nodes.  Then,  for  each  i  G  Vj,  t  G  T,  add  Q  arcs  (h,  i),  \/h  G  S',  to  the 
spread  network.  Note  that  our  construction  implies  that  the  spread  network  for  x  is  not  necessarily 
unique,  because  more  than  one  such  set  S'  may  exist  (see  Figure  18  for  an  example). 

For  alH  G  14,  define: 

().,  =  {h  G  14  :  there  exists  a  directed  path  on  G4  from  node  h  to  node  i}, 
and  hence,  i  G  ()%.  Next,  consider  any  x  G  X  and  define: 

lx  =  {i  £  14  ;  Oi  n?i/  0}, 

i.e.,  Ix  is  the  set  of  all  nodes  i  G  14  that  are  either  protected  in  x,  or  such  that  there  exists  a  directed 
path  on  Gs  from  some  node  h  G  Px  fl  14  to  node  i.  In  the  following  lemma  and  theorem,  we  derive 
alternative  valid  inequalities  for  (104)  by  using  the  idea  of  the  spread  network. 


t  =  0  t=  1  t  =  2 


t  =  0  t=  1  t  =  2 


Figure  18:  Two  possible  spread  networks  for  Figure  17. 


Lemma  15  Given  x  G  X,  let  (i/\  . . .  ,yT)  be  optimal  to  ATTl(x)  with  corresponding  vector  t. 
For  any  x  G  X,  we  have: 

z(x)  >  ^2  rj3  ■ 
jeva\i£ 


(111) 


Theorem  17  Let  (x,  z)  be  an  optimal  solution  to  DEF-R,  and  suppose  that  z(x)  >  Also,  let 
Q  be  any  ( undirected )  acyclic  graph  that  is  constructed  over  Vx,  and  denote  by  A  its  set  of  arcs. 
Finally,  define  Aj ,  Vj  G  Vx,  as  the  set  of  arcs  (u,  v)  G  A  such  that  u  G  03  and  v  G  Oj.  Then,  the 
following  inequality: 


z 


is  14 


J2Xi+ 


i&Oi 


( u,v)eAj 


is  valid  to  (104)  and  cuts  ojf(x,  z). 


(112) 


Corollary  2  Let  (x,  z)  be  an  optimal  solution  to  DEF-R,  and  suppose  that  z(x)  >  z.  If  A  =  0  in 
Theorem  17,  then  the  following  inequality: 


z  >  z(x )  —  |  nun  <  z[x)  —  z 

i&\ 4 


E 


mm’  ■  3 

jeVx-.  a  Oj 


X; 


(113) 


is  valid  to  (104)  and  cuts  off  (x,  z). 


Using  Theorem  17  and  Corollary  2,  we  can  employ  CPA  equipped  with  valid  inequalities  of  the 
form  (112)  or  (113)  instead  of  (110)  in  Step  3  of  CPA.  The  motivation  for  using  these  inequalities 
stems  from  the  following  theorem  that  compares  (110)  to  (1 13). 


Theorem  18  Inequality  (113)  is  at  least  as  strong  as  (110). 


A  similar  theorem  cannot  be  stated  that  compares  the  strength  of  inequalities  (112)  and  (113).  If 
inequality  (113)  was  weakened  by  replacing  the  coefficients  of  xt  with  J2jeV_.  ry7  (instead  of 
the  minimum  of  that  term  and  z(x)  —  zmin),  then  (112)  would  be  at  least  as  strong  as  (113)  due  to 
the  subtraction  of  quadratic  terms  present  in  (112). 


A  further  consideration  in  implementing  CPA  with  valid  inequalities  (112)  regards  the  linearization 
of  the  quadratic  terms  in  these  inequalities.  By  restricting  the  set  of  arcs  that  can  belong  to  the  set 
A,  over  all  generated  inequalities  (112),  we  can  limit  the  number  of  quadratic  terms  that  must 
be  linearized.  We  linearize  each  quadratic  term  xtx3  by  substituting  it  with  a  continuous  variable 
xfj  >0,  and  including  the  inequality  xb  >  x,  +  x3  —  1  in  DEF-R.  (The  inequalities  xfj  <  xt  and 
Xjj  <  Xj  usually  required  to  linearize  this  quadratic  term  are  not  necessary,  because  optimization 
forces  each  variable  to  take  its  smallest  value  allowed  by  Xi  and  x3.) 


Recall  that  multiple  spread  networks  can  be  derived  for  a  given  x  G  X  and  its  optimal  response 
y  —  (y°, ,  y1),  each  of  which  might  correspond  to  a  different  valid  inequality  of  the  form  (112) 
or  (113).  Given  a  candidate  spread  network,  Gs,  corresponding  to  x  and  y,  we  seek  a  mechanism 
for  modifying  Gs  to  an  alternative  spread  network,  Gfi  such  that  the  inequality  (113)  generated 
corresponding  to  G'l  is  at  least  as  strong  as  the  one  corresponding  to  Gs. 


Theorem  19  Consider  a  spread  network  G-r  ( \f ,  Af)  for  which  there  exist  nodes  i,  j.k  G  such 
that  i  G  V~(k),  (i.  k)  f  As,  ( j ,  k)  G  As,  and  a  path  exists  from  i  to  j  on  Gs.  Let  Gs  be  a  modified 
spread  network  obtained  by  replacing  arc  (j,  k)  in  Gs  with  arc  (i.  k ).  The  valid  inequality  (113) 
induced  by  Gs  is  at  least  as  strong  as  that  induced  by  G& 


Figure  19  illustrates  an  instance  of  the  problem  with  T  =  2  and  Q  =  3  in  which  all  rewards  equal 
1  and  Zm ^  =  1.  For  a  given  x,  let  Gs  be  a  spread  network  presented  in  Figure  19a.  Note  that 
z(x)  =  7.  Then,  the  following  inequality 


z  >  7  —  ?xx\  —  4x2  —  4x3  —  3x4  —  2xs  —  2x6  —  x7, 

is  induced  by  Gs  from  Corollary  2.  Next,  suppose  that  there  exists  an  arc  (4,  7)  G  A  and  note 
that  (4,  6)  G  As.  Using  Theorem  19,  we  obtain  a  modified  spread  network  Gs  from  G:r  by  adding 
arc  (4,  7)  and  removing  arc  (6,  7).  (See  Figure  19b.)  By  using  Corollary  2  for  we  obtain  the 
inequality 

Z  >  7  —  3x±  —  4:X2  —  4^3  —  3X4  —  2x5  —  Xe  —  X7, 

which  is  stronger  than  the  inequality  induced  by  Gs  due  to  the  ay-coefficients  in  these  inequalities. 

It  is  worth  noting  that  the  inequality  (112)  induced  by  Gs  may  not  necessarily  be  as  strong  as  that 
induced  by  Gs  in  general.  Let  A  =  {(2,  6),  (3,  6)}  be  the  set  of  arcs  used  to  generate  the  quadratic 
terms  in  (112).  Inequalities 


z  >  7  —  3xi  —  4x2  —  4x3  —  3x4  —  2x5  —  2x6  —  xt  +  2x2x§  +  2x3X6,  (1 14) 


and 


z  >  7  —  3xi  —  4x2  —  4x3  —  3x4  —  2x5  —  x6  —  x7  +  x2x6  +  x3x6,  (115) 


are  induced  by  Gs  and  Gs,  respectively,  from  Theorem  17.  To  see  that  (114)  and  (115)  do  not 
dominate  one  another,  we  show  that  the  RHS  for  one  constraint  need  not  always  be  larger  than  the 
RHS  for  the  other  constraint.  For  x'  =  (0,  0,  0,  0,  0, 1,  0),  note  that  the  RHS  of  inequality  (114)  is 
5,  while  the  RHS  for  (115)  is  6.  However,  for  x"  =  (0, 1, 1,  0,  0, 1,  0),  the  RHS  of  (114)  is  1,  and 
the  RHS  of  (115)  is  0.  ■ 


Algorithm  18  describes  our  method  for  modifying  a  given  spread  network  using  the  idea  of  Theo¬ 
rem  19  in  order  to  strengthen  valid  inequality  (113). 

Algorithm  18  examines  all  candidates  for  node  k  (as  defined  in  Theorem  19)  from  among  the 
nodes  in  Vf  \  . . . ,  Vf,  in  that  order.  Given  a  choice  of  k,  the  algorithm  starts  by  creating  a  list  Lk, 
containing  all  nodes  j  G  V~(k )  that  are  influenced  at  some  time  earlier  than  fk.  The  algorithm 
examines  each  arc  (j,  k )  G  As  in  nonincreasing  order  of  arc  lengths  (i.e.,  nodes  j  are  considered 
in  nonincreasing  order  of  their  Tj- values).  Algorithm  18  seeks  a  node  i  G  Lk.  ( i,k )  (f  As, 
having  the  smallest  value  of  f,  such  that  there  exists  a  path  from  node  i  to  node  j  (i.e.,  such  that 
ADJ (i,j)  =  1).  In  case  such  node  is  found  (with  r,  <  fj),  nodes  i,  j,  and  k  satisfy  the  criteria  of 
Theorem  19,  and  so  we  replace  arc  (j,  k )  with  arc  (1,  k )  in  /17.  This  process  repeats  until  no  more 
arcs  can  be  replaced. 


Figure  19:  Spread  network  modification  using  Theorem  19. 


Note  that  as  Algorithm  18  proceeds,  the  spread  network  might  be  modified  by  “add”  or  “remove” 
operations  performed  in  Step  15.  However,  the  elements  of  matrix  AD  J  are  never  updated  through¬ 
out  the  execution  of  Algorithm  18.  This  is  due  to  the  fact  that  ADj(i,j)  correctly  indicates  the 
existence  of  a  path  between  nodes  i  and  j  whenever  it  is  examined  in  Step  14,  even  though  the 
spread  network  might  have  been  modified  in  earlier  stages  of  Algorithm  18.  To  see  this,  suppose 
that  at  some  stage  of  Algorithm  18,  the  value  of  AD  J (i,j)  is  examined  while  visiting  node  k  £  14 
in  the  for-loop  at  Step  4.  Because  this  for-loop  examines  candidate  nodes  k  in  nonincreasing  or¬ 
der  of  their  f -values,  Algorithm  18  could  have  only  modified  the  spread  network  by  adding  arcs 
(T,  k')  for  some  node  i'  G  Vs  and  k'  G  I/J,  t  >  fk,  or  removing  arcs  ( j k ')  for  some  node  j'  G  Vs 
and  k'  G  t  >  fk.  Recall  that  the  spread  network  contains  no  arcs  (u,  v)  such  that  tu  >  tv. 
Therefore,  the  addition  or  deletion  of  arcs  in  Step  15  cannot  create  a  new  path,  or  disconnect  an 
existing  path,  from  node  i  to  node  j. 

To  analyze  the  complexity  of  Algorithm  18,  observe  that  the  construction  of  matrix  ADJ  takes 
0{Q\  Vx  |2)  steps.  For  each  node  k  examined  in  the  for-loop  at  Steps  3  and  4,  Algorithm  18  performs 
one  sorting  operation  (Step  6),  which  is  (9(|I4|  log  |I4|).  For  each  node  j  examined  in  the  for-loop 
in  Step  7,  Algorithm  18  executes  0{ |I4|)  operations  in  the  while-loop  at  Step  11  corresponding  to 
each  candidate  node  i.  (Note  that  an  arc  {i,  k )  that  is  added  to  after  removing  some  arc  ( j ,  k) 
might  be  replaced  later  by  some  other  arc  (i' .  k )  as  the  algorithm  proceeds,  which  implies  that  a 
total  of  0( \Vx\)  nodes  might  be  examined  in  the  for-loop  in  Step  7).  Therefore,  for  each  node  k 
examined  in  the  for-loops  at  Steps  3  and  4,  Algorithm  18  performs  0( |14|2)  operations,  and  hence, 
the  overall  complexity  of  Algorithm  18  is  0(Q \VS\2  +  14 1 3 ) .  In  fact,  the  complexity  can  be  more 
specifically  stated  as  0( |14|3):  If  Q  <  |14|,  then  this  is  obviously  true,  and  if  Q  >  |14|,  then 
every  node  in  the  spread  network  was  influenced  at  time  0,  A s  would  necessarily  be  empty,  and 
the  algorithm  would  terminate  in  constant  time. 


Attacker’s  Problem  Solution  Approach.  In  order  to  generate  the  valid  inequalities  introduced 
before,  we  must  solve  the  (NP-hard)  attacker’s  problem.  Therefore,  the  efficiency  of  our  solution 
method  is  highly  dependent  on  the  time  required  to  solve  instances  of  the  attacker’s  problem. 
This  motivates  further  investigation  of  the  attacker’s  problem  with  the  aim  of  devising  alternative 
formulations  that  can  be  more  efficiently  solved  by  mathematical  optimization  techniques. 

Note  that  once  the  //'-variables  are  fixed,  the  optimal  value  of  each  //--variable  for  t  G  T  can  be 
readily  determined  via  a  polynomial-time  procedure,  which  starts  from  time  1  and  identifies  the 
number  of  influenced  nodes  adjacent  to  node  i  at  time  0.  Then,  y\  =  1  if  —  0  and  at  least  Q 
nodes  adjacent  to  node  i  are  influenced  at  time  0,  and  y\  =  0  otherwise.  By  repeating  the  same 
operation  for  all  other  time  periods,  the  optimal  value  of  each  y\ -variable  will  be  either  zero  or  one. 

This  observation  suggests  that  a  mathematical  programming  formulation  for  the  attacker’s  problem 
that  includes  only  \V\  binary  variables  may  be  attainable.  However,  the  constraint  (103f)  cannot 
be  relaxed  in  model  (103),  which  indeed  requires  0{T\V\)  binary  variables.  We  investigate  two 
alternative  formulations  for  the  attacker’s  problem  that  allow  us  to  relax  the  binariness  restriction 
on  //--variables  for  t  G  T. 

Exponential  Model.  For  each  i  G  V,  define  Si  —  {S  :  S  C  |Sj  =  \V~(i)\  —  (Q  —  1)}.  The 

following  is  a  reformulation  for  model  (103). 


ATT2(x)  :z(x)  =  max  r°//°  +  ^r\{y\  -  y\  ')  )  (116a) 

iev  V  t= l  / 

s.t.  y\  <y°  +  Yl  yt1  Vi  eV,  t  eT,  S  e  St  (116b) 

j&s 

y\  g  {0, 1}  VieV,teT  (116c) 

Constraints  (103b).  (103d),  and  (103e).  (116d) 


Note  that  the  only  difference  between  models  (103)  and  (116)  lies  in  the  constraints  that  govern  the 
spread  of  influence.  According  to  constraints  (116b),  if  node  i  G  V  is  initially  influenced,  then  the 
RHS  of  constraints  (116b)  will  be  at  least  one  for  all  t  G  T  and  S  G  Si,  implying  that  node  i  will 
remain  influenced  at  all  time  periods.  Now,  suppose  that  node  i  G  V  is  not  initially  influenced,  and 
examine  constraints  (116b)  at  time  t  G  T.  If  fewer  than  0  nodes  adjacent  to  node  i  are  influenced 
at  time  t  —  1,  then  there  exists  a  subset  S  e  St  such  that  no  node  in  S  is  influenced  at  time  period 
t  —  1.  In  this  case,  y\  =  0  due  to  constraint  (116b)  corresponding  to  S.  Otherwise,  the  RHS  of 
constraints  (116b)  for  all  S  G  S,  will  be  at  least  one  for  node  i  at  time  period  t,  and  hence,  y\  =  1  at 
optimality  if  xt  =  0.  The  following  theorem  demonstrates  that  constraint  (116c)  can  equivalently 
be  relaxed  to  take  continuous  values. 

Theorem  20  Consider  Problem  ATT2(x)  for  any  x  e  X,  in  which  constraints  (116c)  are  replaced 
with  0  <  y\  <  1,  Vi  e  V,  t  e  T.  There  exists  an  optimal  solution  (y°, . . . ,  yT)  to  this  relaxation 
in  which  y\  G  (0, 1},  Vi  G  V,  t  G  T. 

Using  Theorem  20,  we  henceforth  relax  constraint  (116c)  to  0  <  y\  <  1,  Vi  G  V,  t  G  T,  in 
ATT2(x). 


We  now  investigate  the  application  of  Benders’  decomposition  in  solving  model  (116).  Observe 
that  model  (116)  reduces  to  the  following  linear  program  for  given  vectors  x  and  y°: 


max  Y  (Y^  -  ri+l)Vi  +  (117a) 

i€V  \t=  1  / 

s.t.  y]  <$  +  Y  fj  Vi  G  V,  S  G  Si  (117b) 

jes 

y\  -  Y  vt1  <  £  Vi  g  v,  t  g  T\{ l},  5  g  5,  (live) 

jes 

y\  <  1  —  Xi  Vi  G  V,  t  G  T  (117d) 

y\>  0  Vi  G  V,  t  G  T.  (117e) 


Let  7T,j  s,  7r|  s,  and  n\  be  the  dual  variables  associated  with  (1 17b),  (1 17c),  and  (1 17d),  respectively. 
Defining  Sj:i  —  {.S'  :  S  G  Sj,  i  G  S'}  as  the  set  of  all  sets  S  G  St  that  include  node  i,  we  obtain 
the  dual  problem  to  (1 17)  given  x  and  y° : 


min  Y Y Y  y°<s +YY ^  yf)nls  +  Y x *)/4  ^ 18a) 

iev  t= 2  Se5i  iev  SeS;  jeS  iev  t= 1 

s-t-  <s  -  +  /4  ^  rf  -  ri+1  Vi  G  V,  t  G  r\{T}  (118b) 

Se*Si  jev+(i)  Se5j,i 

nls  +  yj  >  rI  Vi  G  V  (118c) 

SeSi 

nls  >  0  Vi  eV,  S  eSh  t  eT  (ll8d) 

n\>  0  Vi  G  V,  f  G  T.  (118e) 


Note  that  an  optimal  solution  must  exist  to  problem  (118),  because  the  objective  function  value  is 
always  nonnegative,  and  a  feasible  solution  can  be  obtained  by  setting  /j-  =  r\  —  r-+ 1 .  Vi  G  V,  t  G 
T,  with  all  7T- variables  equal  to  zero.  Letting  5  denote  the  set  of  all  extreme  points  to  problem 
(118),  the  Benders’  master  problem  is  given  as: 


max  i/j 

s.t.  ^  <  Y(r°i  - rl)y°i  +  Y  Y  ^Isivi  +  Y yi) 

i£V  i£V  SeSi  j£S 

+YYY  *Uvi  +EB1- **)#  v(7f,y)GS 

iev  t=2  Se-Si  iev  teT 

y°  e  Y(x), 


(119a) 


(119b) 

(119c) 


with  problem  (117)  being  the  Benders’  subproblem.  The  restricted  master  problem  (RMP)  is 
given  by  (119)  with  only  a  limited  set  of  dual  extreme  points,  denoted  by  H,  and  corresponding 
constraints  (119b). 


Note,  however,  that  problem  (117)  has  an  exponential  number  of  constraints  (1 17c).  Therefore,  we 
aim  to  solve  this  subproblem  using  methods  other  than  linear  programming  techniques. 

Let  y  =  (y1, . . .  ,yT )  be  an  optimal  solution  to  problem  (117),  and  suppose  yj  =  0  for  some 
unprotected  node  i  E  V  and  time  t  E  T.  Then,  there  must  exist  some  Sj  E  Si  such  that  no  node 
in  Sj  is  influenced  at  time  t  —  1.  We  refer  to  Sj  as  a  safe  subset  for  node  i  E  V  and  time  t  E  T. 
It  is  worth  noting  that  a  safe  subset  for  node  i  such  that  y\  =  0  is  a  safe  subset  for  all  time  t  <  t' . 
We  will  thus  discard  the  /-index  from  Sj,  and  simply  refer  to  S,  as  a  safe  subset  for  node  i  for  all 
time  periods  t  such  that  yj  =  0.  We  provide  a  dual  recovery  algorithm  (DRA)  for  identifying  an 
optimal  solution  to  problem  (118)  as  follows. 

Step  1  For  all  i  E  V,  if  x\  —  1  or  yj  =  1,  then  set  pj  =  rj  and  nfs  =  0,  \/S  E  Si.  Otherwise, 
set  pj  =  0,  TtJ'g  =  rf,  and  7 tjjs  =  0 ,  \/S  E  Si\{Si}.  Initialize  t  =  T. 

Step  2  If  t  —  0,  then  terminate.  Otherwise,  set  t  =  t  —  1  and  proceed  to  Step  3. 

Step  3  For  every  i  E  V: 

a.  If  Xi  =  1,  then  p\  =  rj  -  rj+1  +  ^jeV+{i)  E ses^  and  *\,s  =  0,  Vf  G  T\{T},  S  E  St. 

b.  If  ay  =  0  and  yj  =  0,  then  set  pj  =  0,  7 f*g.  =  rj  -  rj+1  +  Ejev+(i)  Eses,  ,  ^1’  and 

*ts  =  0,  \/S  E  Si\{Si}. 

c.  If  Xi  =  0  and  yj  =  1,  then  set  pj  =  rj  —  rj+1  and  tt[5  =  0,  VS1  G  S,. 

Proceed  to  Step  2. 


In  the  following  lemma,  we  establish  the  optimality  of  the  solution  identified  by  DRA. 


Lemma  16  Suppose  that  the  solution  y  =  (y 1 , . . .  ,yT )  is  optimal  to  problem  (117).  Let  Si  be 
a  safe  subset  for  each  unprotected  node  i  E  V  such  that  yj  =  0  for  some  t  E  77  Then,  DRA 
constructs  an  optimal  solution  [ft,  p)  to  problem  (118). 


An  immediate  result  from  Lemma  16  is  that  we  only  need  to  identify  a  single  safe  subset  S)  for 
each  unprotected  node  i  E  V  that  is  not  influenced  at  time  1.  This  allows  us  to  discard  S'-indices 
from  the  7r-variables  when  referring  to  problem  (118),  and  to  rewrite  constraints  (119b)  as: 


i&V  i£V  jeSi  i&V  t= 2  i£V  ter 


or  equivalently, 


iev 


Y,  e1  +  Y** 

j:ieSj 


YY^1  -  Xi^\- 


t= 2 


iev  teT 


(120) 


Inequality  (120)  can  be  strengthened  by  a  standard  coefficient  tightening  procedure  as  follows.  Let 
rj i  be  the  coefficient  of  variable  y-J,  i  G  V,  in  (120).  The  following  inequality: 


^  <  E  min{^’  Zmax(x)  -  E  E(X  "  X<)/4}  )  +  E  E^1  “  Xi )//i>  (121) 

*ev  V  iev  ter  /  tev  ter 

is  valid  to  (119),  because  ry  >  0  and  j/9  G  (0, 1},  Vi  G  V;  zmax(x)  -  Y,tev  Eter(1  “  >  0 

(noting  that  Yliev  YhteT^  —  xt)l4 's  the  optimal  attacker’s  objective  in  the  last  inequality,  which 

is  no  more  than  zmax(x))',  and  V  <  zm ax(x).  Thus,  when  solving  the  Benders’  master  problem,  we 
replace  (119b)  with  (121). 


We  can  also  consider  an  alternative  compact  (polynomial-size)  formulation  for  the  attacker’s  prob¬ 
lem,  in  which  the  binary  restrictions  on  the  ^-variables  can  be  relaxed.  For  each  i  G  V,  arbitrarily 
order  the  nodes  in  V~(i )  as  (*i, . . . ,  i\v-(i)\}-  Define  v\mk  =  1  if  at  least  k  of  first  m  nodes  in  V~(i) 
are  influenced  at  time  t  —  1,  and  vjmk  =  0  otherwise.  By  convention,  we  let  v'lrnk  =  0,  k  >  m. 
Letting  =  { 1 .....  p}  for  any  positive  integer  p,  the  following  is  a  reformulation  for  model 
(103),  given  x: 


ATT3(a:)  :  max  ^  (r°y°  +E'ri(^ 
iev  \  t=  l 


(122a) 


ST  ximk  —  ^i,m—  l,k—  1 


<  Vtm-l,k  +  U 


t~  1 


Jimk 


y\  <  Vi  + 


i,\V~{i)\,Q 


y\  <  1  -  ^ 
vlmk  e  {0, 1} 
y\  e  {o,  1} 

p°  e  y(x). 


Vi  G  V,  t  G  T,  m  G  N|y-(q|,  k  G  Nmin{miQ|  (122b) 
Vi  G  V,  f  G  T,  m  G  N|y-(q|,  /c  G  Nmin{miQ}  (122c) 
Vi  G  V,  t  G  T  (122d) 

Vi  G  V,  t  G  r  (122e) 

Vi  G  V,  t  G  T,  m  G  N|y-(q|,  A;  G  -Nmin{m,<3}  (122f) 
Vi  G  V,  f  G  T  (122g) 

(122h) 


The  objective  function  (122a)  is  the  same  as  the  objective  function  in  model  (103).  Constraints 
(122b)  and  (122c)  enforce  the  definition  of  v\mk.  To  see  this,  suppose  that  fewer  than  k  of  the  first 
m  nodes  in  V~  (i)  are  influenced  at  time  t  —  1.  If  node  im  is  influenced  at  time  t  —  1,  then  at  most 
k  —  2  of  first  m  —  1  nodes  in  V~  (i)  can  be  influenced  at  time  t  —  1.  This  implies  that  v\  m_lk_1  =  0, 
and  constraints  (122b)  force  =  0.  Otherwise,  if  irn  is  not  influenced  at  time  t  —  1,  then  at  most 
k  —  1  of  the  first  m  —  1  nodes  in  V~  (i)  are  influenced  at  time  t  —  1,  i.e.,  u-  m_!  =  0,  and  constraints 
(122c)  force  v\mk  =  0.  On  the  other  hand,  if  at  least  k  of  the  first  m  nodes  in  V~  ( i )  are  influenced 
at  time  t  —  1,  then  at  least  k  —  1  of  the  first  m  —  1  nodes  were  influenced  at  time  t  —  1.  Furthermore, 
either  at  least  k  of  the  first  m  —  1  nodes  were  influenced,  or  node  trn  itself  was  influenced  at  time 
t  -  1.  Hence,  v{m_l  k_x  =  1  and  +P*"1  >  1,  which  allows  v\mk  >  1  (as  will  be  the  case 

at  optimality).  Constraints  (122d)  imply  that  node  i  cannot  be  influenced  at  time  t  unless  either  it 
has  been  initially  influenced  or  at  least  Q  of  its  adjacent  nodes  are  influenced  at  time  t  —  1.  The 
binariness  of  the  v-  and  y- variables  and  the  budget  limit  are  enforced  by  constraints  (122f)-(122h). 
However,  the  following  theorem  demonstrates  that  constraints  (122f)  and  (122g)  can  equivalently 
be  relaxed  to  take  continuous  values. 


Theorem  21  Consider  the  relaxed  version  of  ATT '3 (x)  in  which  constraints  (122f)  and  (122g)  are 
replaced  with  the  following  constraints: 


0  <  v\mk  <1  Vi  G  V,  t  G  T,  m  G  N|V-W|,  k  G  Nmin{m,Q}  (123a) 

0  <  yl  <  1  Vi  G  V,  t  G  T.  (123b) 

There  exists  an  optimal  solution  (y,v)  to  the  relaxed  problem  in  which  v\rnk  G  (0, 1},  Vi  G  V,  t  G 
T,  m  G  N|v-(i)|,  k  G  Nmin{m,Q},  and  y\  G  (0, 1},  Vi  G  V,  t  &T. 


We  thus  replace  (122f)  and  (122g)  with  (123a)  and  (123b),  respectively.  Note  that  while  only  \V\ 
binary  variables  are  needed  in  model  (122),  the  formulation  requires  the  addition  of  0{TQ\V\2) 
continuous  variables.  Table  5  compares  the  size  of  the  proposed  three  formulations  for  the  at¬ 
tacker’s  problem. 


Computational  Summary.  Recall  that  ATT2  is  designed  to  combat  the  growth  of  mathematical 
programming  models  as  a  function  of  T,  wherein  the  DRA  method  executes  a  low-polynomial-time 
routine  to  calculate  the  impact  of  an  attacker’s  action  and  generate  a  Benders’  cut.  The  tradeoff  is 
that  ATT2  requires  the  solution  of  a  (mixed-integer)  master  problem  that  may  require  the  addition 
of  many  cuts.  Let  a  be  the  ratio  of  the  number  of  nodes  that  cannot  be  initially  attacked  to  \V\. 
We  observe  that  when  a  =  40%,  ATT1  still  outperforms  the  other  two  variants.  However,  ATT2 
outperforms  ATT1  and  ATT3  for  a  =  70%.  Evidently,  when  a  changes  from  40%  to  70%,  the 
Benders’  master  problem  becomes  less  difficult  to  solve,  and  solving  ATT2  becomes  the  most 
efficient  approach. 

For  the  defender’s  problem,  recall  that  Step  2  of  CPA  requires  the  solution  of  the  attacker’s  problem 
given  a  defender’s  decision  vector.  We  employ  formulation  ATT1  to  solve  the  attacker’s  problem, 
and  find  that  CPA3  outperforms  all  other  variants.  In  particular,  CPA3  outperforms  CPA1  as  pre¬ 
dicted  by  Theorem  18.  Full  results  are  given  in  Hemmati  et  al.  (2014). 


10  Dynamic  Shortest  Path  Interdiction 


Most  contemporary  network  interdiction  problems  can  be  described  as  Stackelberg  games  in  which 
two  agents  (a  user  and  an  attacker)  with  opposed  interests  interact  in  a  network.  In  these  games 
the  user  wishes  to  optimally  transmit  flows  through  the  network,  while  the  attacker  optimally 
compromises  some  limited  set  of  network  elements  to  disturb  the  user  operation.  The  shortest- 
path  interdiction  (SPI)  problem  is  a  two-stage  game  in  which  the  attacker  acts  first,  and  the  user 
acts  second  with  full  knowledge  of  the  attacker’s  actions.  Knowing  that  the  user  will  select  a 
shortest  path  between  two  known  nodes,  the  attacker  interdicts  a  subset  of  arcs  by  increasing  their 
cost,  or  perhaps  by  preventing  travel  on  those  arcs.  The  SPI  is  typically  formulated  as  a  max-min 
optimization  problem,  in  which  the  attacker’s  actions  cannot  change  as  the  user  travels  the  network. 

In  the  SPI  the  user  has  the  advantage  of  seeing  the  attacker’s  decisions  before  selecting  its  path. 
An  alternative  approach  is  taken  in  the  robust  shortest  path  (RSP)  problem  (Bertsimas  and  Sim, 


2003),  in  which  the  user  first  selects  (and  commits  to)  a  path,  and  then  the  attacker  interdicts  arcs 
to  maximally  increase  the  path’s  cost,  given  a  budget  constraint  on  the  number  of  arcs  that  can 
be  interdicted.  In  comparison  to  the  SPI,  the  attacker  is  at  an  advantage  in  the  RSP,  having  full 
knowledge  of  the  user’s  path  before  taking  any  action. 

To  illustrate  the  interaction  between  the  user  and  attacker,  consider  the  graph  depicted  in  Figure 
20.  Uninterdicted  traversal  costs  are  shown  alongside  each  arc.  If  an  arc  is  interdicted,  its  cost 
increases  by  the  value  shown  in  parentheses.  (For  instance,  traversing  arc  (l,t)  has  a  cost  of  4 
if  the  arc  is  not  interdicted,  and  a  cost  of  12  if  it  is  interdicted.)  Suppose  that  the  user  wants  to 
move  from  node  s  to  node  t  and  that  the  attacker  can  interdict  two  arcs.  Figure  20a  illustrates  the 
optimal  SPI  solution.  In  this  case  the  optimal  strategy  for  the  attacker  is  to  interdict  arcs  (s,  1) 
and  (2,  t).  Given  these  attacks,  the  user  follows  the  path  s  — >  1  — >■  t,  which  has  an  optimal  cost 
of  z*SPJ  =  8.  Figure  20b  illustrates  the  optimal  solution  for  the  RSP,  in  which  the  optimal  user’s 
path  is  s  — >  1  — >•  3  — >■  t.  Given  this  path,  the  attacker  interdicts  arcs  (1,  3)  and  (3,  t),  producing 
an  optimal  objective  of  z*RSP  =  13.  Not  surprisingly,  z*RSP  >  z*SPI ,  because  the  user  has  the 
advantage  of  knowing  the  interdicted  arcs  in  the  SPI,  whereas  the  attacker  has  the  advantage  of 
knowing  the  user’s  path  in  the  RSP. 

In  this  article  we  propose  a  dynamic  shortest  path  interdiction  (DSPI)  problem,  in  which  a  cardinality- 
constrained  attacker  can  interdict  arcs  whenever  the  user  reaches  a  node  in  its  path.  The  user  sees 
all  interdicted  arcs,  and  is  aware  of  the  attacker’s  remaining  budget.  Accordingly,  the  user  can 
adjust  its  path  dynamically  at  any  point  in  response  to  arc  interdictions.  Hence,  the  DSPI  proceeds 
in  multiple  stages,  where  each  stage  consists  of  a  (possibly  empty)  subset  of  arcs  that  are  inter¬ 
dicted  by  the  attacker,  followed  by  an  arc  traversed  by  the  user.  These  stages  continue  until  the 
user  reaches  the  destination  node. 

Figure  20c  illustrates  the  DSPI.  Initially,  the  attacker  decides  not  to  interdict  any  arc,  and  the  user 
moves  from  s  to  1.  At  this  point,  the  attacker  interdicts  arc  (1,1),  and  the  user  moves  from  1 
to  3.  Upon  arrival  at  node  3,  the  attacker  interdicts  arc  (3,  t)  and  the  user  decides  to  move  back 
to  1.  Because  the  attacker  has  no  remaining  budget,  the  user  reaches  the  destination  node  by 
following  the  path  1  — >•  2  — >■  t.  The  optimal  DSPI  objective  is  thus  given  by  z*DSPI  =  10.  This 
instance  illustrates  two  insights  into  the  nature  of  DSPI  solutions.  First,  because  the  user  knows  the 
attacker’s  budget  at  all  times,  the  user  realizes  upon  visiting  node  1  for  the  first  time  (and  seeing 
the  interdiction  of  (1,  t))  that  the  attacker  can  interdict  one  more  arc.  Thus,  using  arc  (1,  2)  at  this 
point  would  induce  the  attacker  to  interdict  arc  (2,  t ),  trapping  the  user  into  traversing  an  expensive 
path  to  t.  Second,  note  that  unlike  many  other  flow  problems  with  nonnegative  costs,  it  may  be 
optimal  for  the  user  to  return  to  previously  visited  nodes,  as  in  this  example. 

The  DSPI  has  received  almost  no  attention  in  the  literature,  with  the  notable  exception  of  a  study 
by  Khachiyan  et  al.  (2008).  This  work  examines  a  simplified  version  of  the  DSPI  in  which  the 
attacker  can  remove  up  to  a  fixed  number  of  outgoing  arcs  at  each  node.  This  simplified  problem 
is  proven  to  be  polynomially  solvable. 


Problem  Formulation.  Consider  a  directed  graph  G  =  (A/",  A),  where  JV  is  the  set  of  nodes 
and  A  is  the  set  of  arcs.  The  user  seeks  to  travel  from  source  node  s  e  JV  to  destination  node 


1(2) 


1(2) 


1(2) 


4(4) 


(a)  zgpj—8 


(b)  zrsp— 13 


(c)  z*dspi— 10 


Figure  20:  Shortest-path  interdiction,  robust  shortest  path,  and  dynamic  shortest-path  interdiction 

t  £  JV,  s  f  /;,  at  the  minimum  cost,  considering  that  some  arcs  can  be  interdicted  as  the  graph  is 
traversed.  In  the  context  of  this  paper,  the  user’s  path  might  involve  repeated  traversals  of  some 
nodes.  The  cost  of  traversing  arc  (i,  j)  £  A  is  given  by  ci?  >  0,  which  is  increased  by  d,,j  >  0 
units  if  interdicted.  The  attacker  can  interdict  up  to  b  arcs  while  the  user  traverses  the  graph.  For 
a  feasible  interdiction  set  S  (i.e.,  a  subset  of  interdicted  arcs  with  \S\  <  b ),  ci?(,5')  denotes  the  cost 
of  traversing  arc  (i,  j)  £  A.  Formally, 


Cij(S)  = 


Cij  T  dij  if  (i,j)  ^  'S’; 

if 


-'ij 


Let  C(S')  be  a  vector  whose  entries  are  given  by  c^(S'),  for  all  (i,  j)  £  A,  and  define  A{i)  as  the 
set  of  arcs  leaving  node  i,  for  each  i  £  JV.  We  assume  without  loss  of  generality  that  A(t)  =  0. 
At  every  node  in  the  user’s  path,  the  attacker  must  decide  whether  to  expand  the  interdiction  set  S. 
As  the  following  observation  shows,  the  attacker  needs  to  only  consider  interdicting  those  arcs  in 

A*)- 

Observation  1  Suppose  that  the  user  is  at  node  i  £  JV\{t}  in  the  current  path.  Then,  it  is  optimal 
for  the  attacker  to  interdict  only  a  subset  of  arcs  in  A{i). 

This  observation  holds  because  if  it  were  optimal  to  interdict  some  arc  (j,  k )  <f  A[i)  while  the 
user  is  at  node  i,  then  an  optimal  solution  exists  in  which  the  attacker  simply  waits  for  the  user  to 
reach  node  j  before  interdicting  (j,  k ).  Revealing  future  attacks  outside  of  Ait)  allows  the  user  to 
effectively  avoid  (or  mitigate)  the  impact  of  the  interdiction. 

Consider  a  shortest-path  tree  to  t,  computed  using  the  uninterdicted  arc  costs.  The  following  lemma 
demonstrates  that  if  the  attacker  uses  its  entire  interdiction  budget,  it  is  optimal  to  interdict  at  least 
one  arc  in  this  shortest-path  tree. 


Lemma  17  Let  T  be  the  set  of  arcs  in  some  all-to-t  shortest-path  tree  computed  with  costs  C(0). 
If  it  is  optimal  for  the  attacker  to  interdict  b  arcs,  then  it  is  optimal  for  the  attacker  to  interdict  at 
least  one  arc  in  T. 


Observation  2  Lemma  17  requires  the  condition  that  the  attacker’s  optimal  solution  exhausts  the 
entire  interdiction  budget.  The  proof  of  this  lemma  utilizes  the  fact  that  the  attacker  exits  the  game 
after  the  last  arc  is  interdicted,  leaving  the  user  to  select  a  shortest  path  on  the  remaining  network. 
If  the  optimal  attack  does  not  involve  b  interdictions,  then  Lemma  17  is  no  longer  valid,  as  shown 
by  the  example  depicted  in  Figure  21  where  6  =  2.  The  optimal  strategy  for  the  attacker  is  to 
interdict  arc  (s,  2)  when  the  user  is  at  node  s.  The  user  then  follows  the  path  s  — >  2  — >  t  with  no 
further  interdictions:  When  the  user  reaches  node  2,  the  attacker  withholds  action  to  prevent  the 
user  from  traversing  the  cheaper  route  2  — >■  3  — >  t.  As  a  result,  the  attacker  does  not  interdict  any 
arc  in  the  unique  shortest  path  tree  T  —  {(s,  1),  (1,  t),  (2,  3),  (3,  t)}. 


1(2) 

►Traversed  arc  ---►  Interdicted  arc 


Figure  21:  Optimal  DSPI  solution  including  no  arcs  from  T  when  6  =  2 


To  formally  describe  the  attacker’s  optimization  problem,  define  z*(S,  i)  as  the  optimal  value  of 
the  game  if  the  user  is  at  node  i  and  the  attacker  has  already  interdicted  arcs  in  S.  Intuitively, 
z*(S,  i )  is  the  cost  of  the  optimal  path  from  i  to  t,  given  that  the  attacker  has  interdicted  arcs  in  S, 
and  can  still  interdict  6  —  \S\  additional  arcs.  Mathematically, 


z*(S,i)  =  max  <  min  {z’TS'  U  S',  j)  +  CiAS  U  5,/)}  >  ,  (124) 

V  ’  '  {S'\S'CA(i)\S,\SuS'\<b}{jeFS(i)X  v  j  ’ 

where  FS(i )  =  {j  e  Af  |  (■ i,j )  G  A}.  The  attacker  maximizes  the  value  of  the  game  in  (124) 
by  selecting  additional  arcs  to  interdict,  denoted  by  S',  so  that  S  U  S'  <  6  (note  that  S'  =  0  is 
allowed).  Given  the  updated  interdiction  S  U  S',  the  user  then  decides  which  node  to  visit  next 
among  those  in  FS(i).  To  make  this  decision,  the  user  examines  each  j  e  FS(i )  and  considers 
both  the  optimal  value  of  the  game  at  node  j  (given  by  z*(S  U  S',  j))  and  the  cost  of  traversing  arc 
(i,  j)  (given  by  ctj(S  U  S')).  Note  therefore  that  the  optimal  value  of  the  game  is  given  by  z*(f.  s), 
i.e.,  the  optimal  cost  when  the  user  is  at  node  s  and  no  arcs  have  yet  been  interdicted. 

Define  z(S,  i )  as  the  best  achievable  value  of  the  game  if  the  attacker  strictly  expands  the  interdic¬ 
tion  set  S  while  the  user  is  at  node  i,  i.e.,  if  \S'\  >0  in  (124).  Mathematically, 

I  max  i  min  {zNiS  U  S',  j)  +  CidS  U  5,,)}r  if  *  f  t,  151  <  b.  and  S  f  A(i), 

z(S,i)  =  l  {S’\S'CAM\s,\suS'\<b,s>&} \jeFS(i)x  y  ^  1  1  ^  w 

j^O  if  i  =  t,  or  151  =  b.  or  S  =  A{i). 

(125) 

Define  z (S)  as  the  |A/"| -dimensional  vector  whose  entries  are  given  by  z(S,i),  for  all  i  &  A/”. 
Observe  that  if  the  user  is  at  node  t,  or  if  the  attacker  has  no  remaining  interdiction  budget,  or  if 


the  attacker  has  previously  interdicted  all  arcs  in  A(i),  then  we  simply  define  z(S,  i )  =  0.  Using 
(125)  we  can  rewrite  (124)  as 


z*(S,i) 


=  max 


min 

j&FS(i) 


{z*(S,j)  +  Cij(S)} 


(126) 


Exact  Algorithm  for  the  DSPI.  To  solve  the  DSPI  on  a  general  network,  we  propose  a  dynamic¬ 
programming  algorithm  that  calculates  ;A  (S',  i)  for  alii  G  JV  and  for  all  feasible  interdiction  sets 
S.  Suppose  that  vector  z(S')  is  known,  for  some  feasible  interdiction  set  S.  We  first  show  how 
to  calculate  z*(S,  i),  for  all  i  G  JV,  using  a  modified  version  of  Dijkstra’s  algorithm.  Consider 
the  algorithm  FIS  (which  stands  for  “fixed  interdiction  set”),  whose  inputs  are  the  graph  G,  the 
observed  interdiction  set  S,  and  the  vector  z(S').  Algorithm  FIS  follows  similar  logic  as  used  in 
Dijkstra’s  algorithm.  However,  in  this  case,  we  require  the  use  of  two  labels  per  node.  At  node  i  G 
A/”,  G  represents  the  user’s  shortest-path  cost  if  the  attacker  takes  no  action  when  the  user  reaches 
node  i.  Thus,  Ei  will  equal  the  minimum  value  of  z*(S,j )  +  Cij(S),  over  all  j  G  FS(i).  Also, 
ii  represents  the  node  label  from  the  attacker’s  perspective,  and  will  thus  be  the  maximum  of  £t 
and  z(S,  i).  Note  that  when  £t  becomes  permanently  labeled  (and  is  “correct”),  then  ()  =  z*(S,  i), 
allowing  it  to  be  employed  in  subsequent  iterations  of  the  algorithm. 

We  initially  set  Et  —  Et  —  0  and  £t  —  G  —  oc  for  all  i  G  JV\{t}.  We  use  a  priority  queue,  Q,  to  store 
the  temporarily  labeled  nodes  (initially  Q  =  JV)  and  iteratively  remove  a  node  j  having  the  smallest 
value  of  £j  in  Q.  Once  we  remove  a  minimum-labeled  node  j  from  Q  (declaring  Ej  =  z*  (S',  j)),  we 
update  £i  for  all  nodes  i  G  JV  such  that  (i,j)  belongs  to  A.  The  label  updates  are  done  in  the  form 
Ei  =  min{Tj,  Ej  +  ci:j{S)},  as  done  in  Dijkstra’s  algorithm,  and  Er  =  max{(j,  z{S,  /')}  by  definition 
of  Ei .  In  particular,  note  that  if  z  (.S')  =  0,  then  FIS  becomes  Dijkstra’s  algorithm. 

The  complexity  of  FIS  is  the  same  as  Dijkstra’s  algorithm,  because  the  computations  in  FIS  only 
differ  by  one  comparison  in  line  6  and  one  assignment  in  line  7.  This  complexity  is  given  by 
0(\JV\  log  |  AC  I  +  04|)  if  a  Fibonacci  heap  is  used  to  handle  the  priority  queue  0.  The  correctness 
of  FIS  is  proven  in  Sefair  and  Smith  (2015). 

Consider  the  dynamic-programming  algorithm  DP-DSPI,  whose  inputs  are  the  graph  G  and  the 
attacker’s  budget  b.  Define  T(/c)  as  the  set  of  all  cardinality- A;  subsets  of  A,  Vk  —  0, . . . ,  b.  Algo¬ 
rithm  DP-DSPI  initially  calculates  z*  (S',  i)  for  all  cardinality-6  interdiction  sets  that  include  at  least 
one  arc  from  T  (see  Lemma  17).  Because  the  graph  costs  cannot  be  altered  again  by  the  attacker 
if  b  arcs  have  already  been  interdicted,  this  step  can  be  done  by  solving  an  all-to-/  shortest-path 
problem,  for  each  S  G  T(6)  such  that  S  fl  T  V  0-  The  algorithm  then  considers  all  possible  sizes 
for  an  interdiction  set  (in  decreasing  order)  from  b  —  1  to  0.  At  iteration  k  (0  <  k  <  b  —  1),  z(S.  i ) 
is  calculated  for  all  cardinality- k  sets  in  line  3.  (Observe  that  at  this  step  z*(S.  i)  has  already  been 
calculated  for  all  S  G  r(U),  VU  >  k.)  Thus,  z(S,  i)  can  be  calculated  using  (125).  In  line  4, 
z*(S,  i )  is  calculated  for  all  cardinality- A;  sets,  which  is  possible  because  z(S,  i)  was  calculated  in 
line  3.  The  algorithm  returns  ;A(0.  s  ')  upon  termination  in  line  5. 

Although  exact,  DP-DSPI(G,  b)  is  exponential  in  running  time  and  memory.  Lines  1  and  4  of  DP- 
DSPKG,  b)  require  the  solution  of  Ylk= o  (^)  total  shortest-path  problems.  Line  3  requires  the 
computation  of  (125)  for  every  possible  combination  of  interdiction  set  S,  |Sj  <  b,  and  node  i. 


Each  such  calculation  requires  0(|FS'(i)|)  steps  in  the  inner  minimization  loop  and  no  more  than 
(3(2lF5WI)  iterations  over  the  outer  maximization  loop,  for  a  total  of  computa¬ 

tions.  Because  \FS(i)  \  <  |A/”|,  the  total  number  of  computations  required  in  line  3  of  the  algorithm 
is  0{Zt=l  (ltl)|AT|22lA/'l).  Noting  that  \M\22^\  >  max{|A/”|  log  \J\f\.  A },  the  time  complexity 
of  this  algorithm  is  given  as: 

O  (g  (?)  \M\V  +  (?)  (|V|  log  IM  +  Ml  A . 

The  space  complexity  is  governed  by  the  required  calculations  in  line  3  of  the  algorithm.  For  a 
given  value  of  k,  it  is  necessary  at  line  3  to  refer  to  supersets  S  U  S'  when  computing  z(S,  i )  for 
some  S  e  T(/c)  and  i  e  JV.  We  therefore  retain  each  computed  value  of  in  our  algorithm.  (In 
fact,  if  k  decreases  beyond  b—  |«A/] ,  then  it  would  be  permissible  to  “forget”  ^-values  corresponding 
to  larger  interdiction  sets.  However,  we  would  retain  either  those  values,  or  at  least  the  appropriate 
predecessor  information,  in  order  to  recover  the  optimal  combination  of  interdiction  and  user  path 
at  the  end  of  the  algorithm.)  All  other  storage  requirements  (e.g.,  storing  ^-values  within  DP- 
DSPI  or  (-values  within  FIS)  are  dominated  by  the  space  needed  to  store  the  z*-values.  The  space 
complexity  required  by  this  algorithm  is  therefore  given  by  number  of  node-and-interdiction-set 
combinations: 


DSPI  on  Acyclic  Graphs.  The  complexity  of  DP-DSPI(G,6)  is  exponential  because  its  state 
space  tracks  the  set  of  interdicted  arcs.  If  no  cycles  are  present  in  G,  then  only  the  number  of 
arcs  that  have  been  interdicted  must  be  recorded.  This  claim  follows  from  the  fact  that  all  arcs  that 
have  been  interdicted  during  the  game  emanate  from  nodes  previously  visited  by  the  user,  recalling 
Observation  1 .  These  nodes  cannot  be  revisited  by  the  user  because  the  graph  is  acyclic,  and  so  the 
dynamic  programming  state  space  no  longer  needs  to  record  which  arcs  have  been  interdicted. 

Define  v*(k.  i )  as  the  optimal  value  of  the  game  if  the  attacker’s  remaining  budget  equals  k  and  the 
user  is  at  node  i.  We  can  determine  this  value  as: 


max 


V*(k,i)  =  {  {S'|S'CM(i).|5'|<min{fc,|FS(i)|}}  [j£FS(i) 

0 


min  (u*  (. k  -  |S"|,  j)  +  5^(5")}  \  if  i^t, 

if  i  —  t. 


(127) 


In  (127),  the  attacker  maximizes  the  value  of  the  game  by  selecting  a  subset  S  of  arcs  to  interdict 
from  A(i),  given  the  remaining  budget,  k.  Based  on  the  set  S',  the  user  then  decides  which  node 
j  G  FS(i)  to  visit  next,  considering  the  value  of  the  game  at  j  (given  by  v*(k  —  |S"|,  j))  and  the 
cost  of  traversing  arc  (i,  j)  (given  by  cl:J(Sr)). 

To  calculate  v*(k,i),  we  begin  by  examining  the  optimal  user  strategy,  given  that  the  attacker 
decides  to  interdict  arcs  S'  C  A(t).  Fet  rri  =  |S"|,  and  assume  that  m  <  k.  If  the  user  selects  an 


arc  (i,  j)  that  does  not  belong  to  S',  then  the  user  visits  node  ju ,  determined  by 

ju  G  argmin  {v*(k  —  m,j )  +  cl3  }  , 

j:(i,j)EA(i)\S' 

where  ju  is  not  defined  if  S'  =  A(i).  If  the  user  selects  an  arc  (i,  j )  G  S',  then  the  user  would  visit 
a  node  j1  such  that 

j1  G  argmin  {v*(k  -  m,j)  +  cl3  +  dl3 }  . 
j:(i,j)€S' 

Again,  j1  is  undefined  if  S'  =  0.  Define  vu(k,i ,  S")  =  n*(A;  —  m,ju)  +  Cy-u  if  j'7  exists,  and 
vu(k,  i ,  S")  =  oo  otherwise.  Likewise,  define  n7(/c,  i,  S')  =  v*  (k  —  m,  j1)  +  ci3i  +  dt]r  if  j1  exists, 
and  vI{k,  i ,  S')  =  oo  otherwise.  We  then  have  that  v*(k,  i,  S')  =  min {vu(k,  i,  S'),  v\k,  i,  5")}  is 

the  value  of  the  game  if  the  attacker  interdicts  arcs  in  S'  when  the  user  is  at  node  i  and  k  more  arcs 
can  be  interdicted. 


We  now  turn  our  attention  to  the  attacker’s  problem  of  maximizing  v*(k,i,  S')  over  all  sets  S'  : 
|S"|  =  m.  Suppose  that  the  values  of  v*(k  —  m,j)  +  c)?  are  sorted  in  nondecreasing  order  for 
j  =  Ji~m ,  •  •  • ,  J\FS(i)\’  such  that  v*(k  ~  <  •  •  •  <  v*{k  — 

The  following  lemma  states  an  optimal  interdiction  strategy. 


Lemma  18  Consider  a  DAG  G  =  (A f,  A),  a  node  i  G  A f,  and  a  positive  integer  k.  Suppose  that  if 
the  user  reaches  node  i  and  the  attacker  has  a  remaining  interdiction  budget  ofk  arcs,  the  attacker 
chooses  to  interdict  m  arcs,  where  0  <  m  <  min  {A'.  |F,5'(?')|}.  Then  an  optimal  interdiction 
solution  exists  in  which  arcs  (i,jp~m)  are  interdicted,  for  p  =  1 , ,  m. 

We  now  use  Lemma  18  to  derive  a  polynomial-time  dynamic-programming  algorithm,  which  we 
call  DP-DSPI-DAG.  Algorithm  DP-DSPI-DAG  calculates  v*  ( k ,  i)  by  processing  nodes  in  JV  \  {t} 
in  reverse  topological  order.  That  is,  if  ( i,j )  G  A,  then  DP-DSPI-DAG  processes  j  before  i. 
(Recall  that  a  topological  ordering  always  exists  when  G  is  acyclic.)  This  strategy  ensures  that 
when  calculating  v*(k,  i)  using  (127),  for  some  i  E  Af\{t}  and  k  —  0, . . . ,  b,  all  values  v*(k',j), 
Vj  G  FS(i)  and  k'  =  0, . . . ,  b,  have  been  precomputed.  For  each  node  i  G  A/”  \  {t},  algorithm 
DP-DSPI-DAG  uses  the  labels  v(k  —  m,  i)  to  represent  the  user’s  shortest-path  cost  from  i  to  t  if 
the  attacker’s  remaining  budget  is  k  —  m  (after  m  arcs  in  A{i)  are  interdicted)  and  the  user  leaves 
i  using  one  of  the  interdicted  arcs. 

Algorithm  DP-DSPI-DAG  first  sets  v*(k,t)  =  0,  V/c  =  0 Then,  the  algorithm  selects 
the  next  node  i  G  N  \  {t}  to  examine,  and  for  each  possible  budget  k  =  0, . . . ,  h,  computes 
the  value  for  v*(k,i)  in  lines  4-12.  For  node  i  and  budget  k,  we  initialize  v*(k,  i)  =  0  and 
v(k,i)  =  oo  (because  no  arcs  in  A{i)  have  yet  been  interdicted).  In  line  5,  the  algorithm  sorts 
the  values  of  v*(k,j)  +  c,3,  Vj  G  F,S'(/j,  in  nondecreasing  order.  This  sorting  is  used  in  both 
the  current  and  in  future  iterations  to  reduce  computational  effort  in  determining  optimal  attacks 
according  to  Lemma  18.  The  for-loop  in  line  6  calculates  the  attacker’s  best  strategy  by  varying  the 
number,  m,  of  interdicted  arcs,  from  0  to  min  (A;,  F,5'(/j  |}.  If  in  >  0  then  v(k  —  in,  i)  is  updated 
in  lines  7-8  in  the  form  v(k  —  m,i)  =  min {7 (A;  —  m,i),v*(k  —  rn,j^fm)  +  c.^-m  +  d^k-m}. 
Prior  to  executing  line  8,  v(k  —  m,  i)  represents  the  minimum  value  of  v*(k  —  m,j)  +  cl3  +  dij 
over  the  m  —  1  interdicted  arcs  (i,  j)  :  j  G  . . . ,  Thus,  the  second  if-condition 


in  line  7  seeks  to  update  vlk_m  by  examining  the  updated  traversal  cost  of  arc  he.,  the 

next  arc  to  be  interdicted  in  the  sorted  list.  The  algorithm  updates  v*(k,i )  in  lines  9-12  in  the 
form  v*(k,i )  =  max{v*(k,  i),  min{u(/c  —  m,i),v*(k  —  m,jm+ 1)  +  Cijm+1}},  if  m  <  |FS'(i)|, 
or  v*(k,i)  =  max{v*(k,i),v(k  —  m,i)},  if  m  =  |FS'(i)|.  The  algorithm  returns  v*(b,s )  as  the 
optimal  objective  upon  termination  in  line  13. 

To  calculate  the  time  complexity  of  DP-DSPI-DAG,  note  that  the  topological  order  required  in  line 
2  can  be  obtained  in  0(|A/”|  +  |,4|)  time  by  using  a  depth-first-search  (DFS)  algorithm.  Moreover, 
the  sorting  procedure  required  in  line  5  can  be  done  in  0(|FS'(i)|  log  F,S'(/’)|  )  time.  (If  b  is  small 
relative  to  |F5'(*)|,  then  we  could  instead  perform  a  partial  sorting  to  find  the  (6  +  l)-smallest 
values  of  v*(k  —  m,j)+Cij,Vj  G  FS(i).  This  method  could  be  performed  in  0(\FS(i)\  +  blog  b) 
time.)  The  overall  complexity  is  given  by 

o[\N\  +  \A\  +  Y,  EdfSWIloglFSWI  +  mmftlfSWI})  ] 

y  ieAf\{t}  k= o  J 

<0  (|V|  +  M|  +  (t+l)  Y  1^5(01  log |FS(t)|+  Y  X>S«I 

y  ieA/'Vjt}  ieA/'\{t}  fc=o  J 

<  O  (|Ah|  +  |^|  +  (b  +  1)|^|  log  |A/”|  +  (b  +  1)|^|) 

<  0{\A\2  log \J\f\). 

The  first  inequality  holds  given  that  min{£;,  FS(i') \ }  <  \FS(i)\.  The  second  inequality  is  obtained 
by  observing  that  YlieN\{t}  l^(*)l  loS  1^(01  <  log  |Ah|  ^  .gArv{i}  \FS(i)\and'52ieU\{t}  |F5'(i)|  = 
|^4|.  Because  b  <  \A\,  the  algorithm’s  complexity  is  0(|^4.|2  log  \Af\).  In  terms  of  space,  the  bot¬ 
tleneck  is  the  storage  of  the  n*-values,  which  results  in  0(|A/’||^4|)  storage. 


Lower  and  Upper  Bounds.  First,  suppose  that  we  select  a  subset  of  arcs,  S,  that  the  attacker 
must  interdict  before  the  game  begins,  thus  allowing  the  attacker  to  interdict  only  k  —  |<Sj  more  arcs 
while  the  user  traverses  a  path  from  s  to  t.  We  denote  this  game  DSPI(S'),  and  define  zlb(S)  as  the 
optimal  value  of  this  game.  Note  that  zlb(S)  <  zlb(S)  holds  true  for  any  S  F)  S.  This  inequality 
is  due  to  the  fact  that  the  attacker’s  problem  in  DSPI(S')  is  a  restriction  of  that  in  DSPI(S'),  and 
moreover,  the  user  has  more  information  in  DSPI(S')  as  to  the  attacker’s  planned  interdictions  than 
in  DSPI(5). 

Hence,  consider  a  priori  sets  S°, . . . ,  Sb,  where  S°  =  0,  and  for  m  =  1, . . . ,  b,  we  have  Sm  D 
gm-L  an(j  | gm|  _  | sm~ 1  \  + 1 ,  i.e.,  S m  has  one  arc  in  addition  to  those  in  S'™-1.  Clearly,  zLB(S° )  = 
ZDSPI  ’  since  this  corresponds  to  the  case  in  which  no  arcs  are  interdicted  in  an  a  priori  phase,  just 
as  in  the  DSPI.  At  the  other  end  of  the  spectrum,  zlb(S'6)  corresponds  to  the  situation  in  which  the 
attacker  exhausts  the  entire  interdiction  budget  before  the  user  acts.  Hence,  ZLB(Sb )  <  z*SPI,  with 
equality  holding  only  if  Sb  optimizes  SPI.  This  analysis  yields  the  bound  hierarchy 


zLB(Sb)  <  ZLB(Sb  l)  <  ■  ■  ■  <  Zlb^S1)  <  Zlb(S°)  —  Z 


DSPI ■ 


Also,  if  SgPI  optimizes  the  SPI  and  Sm  C  S*SP[  for  some  rri  e  b}.  then  z*SPI  <  zLB(Sm)  < 

* 

ZDSPI- 

Consider  now  the  algorithm  DSPI-LB,  whose  inputs  are  the  graph,  G,  the  attacker’s  budget,  b,  and 
the  number  of  arcs  to  interdict  in  advance,  A.  Algorithm  DSPI-LB  initially  selects  any  set  of  arcs 
S  of  size  A.  Then,  the  costs  of  arcs  in  S  are  revised  to  reflect  the  fact  that  those  arcs  are  already 
interdicted.  The  algorithm  finishes  by  solving  the  DSPI  with  the  updated  budget  and  arc  costs, 
obtaining  zlb(S). 

Although  DSPI-LB  produces  a  valid  lower  bound  for  any  S,  our  implementation  strategy  chooses 
a  set  S'  C  SgPI  to  guarantee  bounds  that  are  at  least  as  tight  as  z*spi ■  After  solving  the  SPI  to 
identify  S*spp  we  construct  S  by  choosing  the  A  arcs  in  S*SPI  that  are  as  close  to  s  as  possible 
(as  measured  by  the  shortest  unweighted  path  from  node  s  to  an  arc’s  from-node).  In  doing  so, 
the  attacker  reveals  as  little  information  as  possible  regarding  future  interdiction  plans,  which  then 
tends  to  yield  a  tighter  lower  bound. 

As  an  alternative  of  DSPI-LB,  consider  problem  DSPI-EXP  (where  EXP  stands  for  “expired  at¬ 
tacks”).  Problem  DSPI-EXP  essentially  modifies  the  game  as  follows.  When  the  user  is  at  some 
node  i  <G  J\f,  the  cost  of  an  interdicted  arc  (i,j)  G  All)  becomes  ctJ  +  dij  during  the  user’s  next 
move,  as  in  the  DSPI.  However,  after  the  user  traverses  some  arc  in  A(i),  the  cost  of  arc  (i,j) 
reverts  to  cip  i.e.,  the  interdiction  expires  after  the  user’s  next  arc  traversal.  Define  ZEXP  as  the 
optimal  value  of  DSPI-EXP.  The  motivation  behind  studying  DSPI-EXP  is  twofold.  One,  because 
interdictions  last  for  only  one  arc  traversal  instead  of  over  the  remainder  of  the  game,  we  have  that 
zexp  A  z*dspi ■  Two,  because  interdictions  expire,  then  just  as  in  the  case  in  which  G  is  a  DAG, 
the  state  space  for  a  dynamic  program  needs  to  record  only  the  remaining  number  of  attacks  rather 
than  the  set  of  previously  attacked  arcs. 

We  now  describe  an  algorithm,  DP-DSPI-EXP,  for  solving  this  modified  game.  As  in  DP-DSPI- 
DAG,  we  define  v*(k,  i )  as  the  optimal  value  of  the  game,  given  that  the  user  is  at  node  i  and  the 
attacker  has  a  remaining  budget  of  k.  Moreover,  define  Ukim  as  the  optimal  value  of  the  game  if 
the  user  is  at  node  i  and  the  attacker,  having  a  budget  of  k,  decides  to  interdict  m  arcs  in  A{i). 
If  m  >  |*4.(i)|,  then  Ukim.  is  not  defined.  Algorithm  DP-DSPI-EXP  also  uses  v(k,i),  the  user’s 
shortest-path  cost  from  i  to  t  if  the  attacker’s  remaining  budget  is  k  after  arcs  in  Ait)  have  been 
interdicted,  and  the  user  leaves  i  using  one  of  the  interdicted  arcs. 

The  algorithm  proceeds  in  b  +  1  stages,  computing  all  values  of  v*(k,i )  in  stage  k,  for  each  i  e 
A f  \  {t}  and  k  =  0, . . . ,  b.  Stage  0  is  performed  by  executing  Dijkstra’s  algorithm,  because  no 
interdictions  can  occur  when  k  —  0.  At  every  subsequent  stage,  we  execute  two  phases:  Phase 
one,  which  consists  of  lines  4-15,  and  phase  two,  which  consists  of  lines  16-23. 

Phase  one  calculates  Ukim,  for  each  i  e  A f\  {t}  and  m  —  1, . . . ,  min  {A,  |  FS(i)  |},  using  previously 
computed  values  of  v*(k,j),  for  j  e  FS(i)  and  k  —  0, . . . ,  b.  The  for-loop  in  line  4  iterates  over 
all  non-terminal  nodes  in  A/",  while  line  5  sorts  the  v*(k  —  1  ,j)  +  Gj  values  as  done  in  DP-DSPI- 
DAG.  After  initializing  v*-  and  u- values,  the  for-loop  starting  on  line  7  iterates  over  every  possible 
number  m  of  interdictions  that  the  attacker  could  choose  at  node  i  with  a  budget  of  k.  Lines  8  and 
9  update  v,  while  lines  10-13  calculate  uPim,  and  lines  14  and  15  update  v*  as  appropriate.  Hence, 
v*(k,  i)  equals  i na xm e { i  i |  rs (?:) |}}  { u kim }  after  the  inner  for-loop  (indexed  by  m)  is  complete. 


In  phase  two,  we  execute  a  modified  Dijkstra’s  algorithm  similar  to  FIS  in  order  to  obtain  the 
remaining  w^o-values,  and  to  finalize  v*(k,i),  \/i  G  A f.  In  this  case,  node  labels  are  given  by 
ma x{v*(k,i),Ukio},  Vi  G  A f,  where  v*(k,  i)  is  initially  computed  in  phase  one  and  u- values  are 
initialized  as  u^a  =  oo,  Vi  G  A/”  \  {/},  and  iikto  =  0.  The  label  updates  are  done  in  the  form 

Uki o  =  mm{uki0,v*(k,j)  +  ctJ}  and  v*(k,j)  =  ma x{v*(k,j),ukj0}. 

The  time  complexity  of  DP-DSPI-EXP  is  driven  by  the  steps  in  lines  2  to  15,  which  is  essentially 
the  same  complexity  as  DP-DSPI-DAG.  The  complexity  of  phase  two  is  given  by  0(\Af\  log  |A/”|  + 
|.4|),  which  is  the  same  as  in  FIS.  Because  |*4|2  log  |A/"|  >  |A/”|  log  |A/”|  +  |*4|,  the  overall  complexity 
of  DP-DSPI-EXP  is  given  by  0(|*4|2  log  \Af\).  In  terms  of  space,  the  bottleneck  is  the  storage  of 
the  sorted  values  in  line  5,  which  results  in  0(|A/’|2|*4|)  storage. 

Computing  an  upper  bound  on  z*DSPI  is  performed  by  restricting  the  user  rather  than  the  attacker. 
This  restriction  is  performed  by  simply  removing  arcs  from  G  to  form  a  graph  6"  =  (JV,A), 
with  A  C  A.  By  choosing  A  so  that  G1  is  a  DAG,  we  can  then  solve  the  DSPI  to  optimality  in 
polynomial  time  using  DP-DSPI-DAG  over  G'.  Letting  zjjb  equal  the  optimal  DSPI  objective  over 
G',  we  then  have  that  z})SPf  <  zjjb- 

To  choose  G',  we  select  a  simple  path  from  node  s  to  node  t,  which  we  denote  by  V.  We  then 
eliminate  arcs  other  than  those  in  V  until  the  resulting  graph  is  acyclic.  By  doing  so,  we  guarantee 
that  G'  contains  at  least  one  path  from  s  to  t.  Algorithm  DSPI-UB  formally  states  the  upper 
bounding  method. 

The  transformation  of  G  into  a  DAG  in  line  2  can  be  done  in  0(|A/”|  +  *4|  )  time  by  using  a 
modification  of  a  DFS  algorithm  in  which  all  arcs  in  V  are  visited  first,  and  then  all  arcs  (i  -j  )  G  A 
that  connect  a  node  i  to  an  ancestor  j  in  the  DFS  tree  (i.e.,  “back  arcs”)  are  eliminated. 

Note  that  by  randomizing  either  the  generation  of  V  and/or  the  way  in  which  G  is  transformed 
to  G',  we  could  obtain  several  upper  bounds  by  solving  DP-DSPI-DAG  over  alternative  acyclic 
subgraphs  of  G,  and  retain  the  best  (lowest)  bound.  A  natural  question  then  arises  as  to  whether 
or  not  there  exists  an  “ideal”  subgraph  G 1  that  yields  a  tight  upper  bound  of  z*DSPI.  The  answer 
to  this  question  is  no,  as  evidenced  by  the  example  depicted  in  Figure  20c.  In  that  example  the 
unique  optimal  solution  requires  the  user  to  visit  node  1  twice,  which  would  not  be  allowed  in 
any  DAG.  Also,  while  we  may  intuitively  seek  a  subgraph  having  as  many  arcs  in  G  as  possible, 
the  problem  of  eliminating  the  fewest  arcs  in  G  so  that  6"  becomes  acyclic  is  equivalent  to  the 
minimum  feedback  arc  set  problem,  which  is  NP-hard. 

All  computational  results  of  our  procedures  and  proofs  can  be  found  in  Sefair  and  Smith  (2015). 
Additionally,  the  same  authors  recently  submitted  another  portion  of  this  work  on  the  Dynamic 
Assignment  Interdiction  problem,  which  was  initiated  due  to  DTRA  support. 


Algorithm  18:  Revising  an  existing  spread  network  using  Theorem  19 


1  Let  Gs  =  (14,  As)  be  a  spread  network  with  corresponding  vector  f ; 

2  Define  ADJ  as  a  |!4|  x  \VS\  matrix,  where  AD  J  (i,j)  =  1  if  there  exists  a  path  from  node  i  to 
node  j  on  Gs,  and  ADJ  (i,j)  =  0  otherwise; 

3  for  t  =  0  to  T  —  2  do 
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for  all  nodes  k  G  V],  1  do 

Initialize  Lk  as  an  array  of  all  nodes  j  G  V~(k)  such  that  t:)  <  T  —  t; 
Sort  nodes  in  Lk  based  on  nonincreasing  values  of  f ; 
for p  =  1  to  \Lk\  do 

Let  j  be  the  pth  node  in  Lk; 

if  (j,  k )  G  As  then 

Set  q  —  \Lk\,  and  let  i  be  the  gth  node  in  Lk; 

Set  flag  repeat  =  true; 
while  (repeat  ==  true)  do 
if  (i,  k )  ^  As  then 

if  ADj(i,j )  =  1  then 

Remove  arc  ( j ,  k)  from  A^  and  add  arc  (i,  k )  to  Ap, 
Set  repeat  =  false; 

end 

else 

Set  q  —  q  —  1,  and  let  i  be  the  qth  node  in  Lk\ 
if  Ti  >  fj  then 

j  Set  repeat  =  false; 

end 

end 

end 

end 

end 

end 

end 


29  end 


Table  5:  Size  comparison  of  attacker’s  problem  formulations. 


Model 

Binary  Variables 

Continuous  Variables 

Constraints 

ATT1 

0(T\V  |) 

0 

0(T\V  |) 

ATT2 

o(\v\) 

0(T\V  |) 

o(T\v\Q) 

ATT3 

0(\V\) 

0(TQ\V\2) 

0(TQ\V\ 2) 

Algorithm  19:  HS(G,  S,  z(S)) 


1  Initialize  U—ti  —  oo,  for  each  i  G  N  \  {£},  and  £t  —  £t  —  0; 

2  Let  Q  be  the  set  of  temporarily  labeled  nodes,  with  Q  =  J\f  initially; 

3  for  h  —  1, . . . ,  |  A/”  |  do 

4  Let  j  be  a  node  having  the  minimum  (temporary)  label  £j  in  Q,  and  remove  j  from  0\ 

5  for  nodes  i  :  (■ i,j )  G  A  do 

6  if  ii  >  £j  +  Cij(S)  and  £i  >  z(S,  i )  then 

7  |  Set  £t  =  £j  +  Cij(S)  and  £t  =  max{4  z(S,  i)}; 

8  end 

9  end 

10  end 


Algorithm  20:  DP-DSPI(G,  b ) 

i  Calculate  z*(S,  i )  for  each  S  G  r(6),  such  that  S'  D  T  ^  0,  and  i  G  A/”  via  FISCG,  S,  0); 


2  for  k  =  b  —  1  dow/7  to  k  =  0  do 

3  Calculate  z(S,  i),  VS  G  r(/c)  and  Vi  G  A/",  via  the  recursion  given  by  (125); 

4  Calculate  z*(S,  i),  VS  G  T(k)  and  Vi  G  JV,  via  FIS(G,  S,  z(S)); 

5  end 

6  Return  z*(0,  s); 


Algorithm  22:  DSPI-LB(G,  b ,  A) 

1  Select  a  set  of  arcs  S  C  .A  such  that  \S\  =  A; 

2  For  all  (i,j)  e  S',  revise  Cjj  to  equal  +  dij,  and  revise  dij  =  0; 

3  Compute  zlb(S)  by  solving  the  DSPI  with  attacker’s  budget  b  —  A  and  revised  arc  costs 
computed  above; 


Algorithm  24:  DSPI-UB(G,  b ) _ 

1  Select  a  simple  path  V  from  s  to  t  in  G; 

2  Transform  G  into  a  DAG,  G' ,  by  eliminating  arcs  from  G  other  than  those  in  V ; 

3  Compute  zUB  as  the  output  of  DP-DSPI-DAG(G',6); 
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Ph.D.  student  Sibel  Sonuc  graduated  in  2012  and  now  serves  as  a  postdoctoral 
assistant  at  Northeastern  University. 

Ph.D.  student  Kelly  Sullivan  graduated  in  2012  and  now  serves  as  an  assistant 
professor  at  the  University  of  Arkansas. 

Ph.D.  student  Yu-Song  Syu  graduated  in  2012. 

Ph.D.  student  Bita  Tadayon  graduated  in  2014. 

Ph.D.  student  Yen  Tang  graduated  in  2013. 

Ph.D.  student  Chrysafis  Vogiatzis  graduated  in  2014  and  will  begin  an  academic 
career  as  a  (tenure-track)  assistant  professor  at  North  Dakota  State  University  in 
August  2015. 

Ph.D.  student  Jose  Walteros  graduated  in  2014  and  now  serves  as  an  assistant 
professor  at  the  University  at  Buffalo. 

Ph.D.  student  Hongsheng  Xu  graduated  in  2012. 

Current  Ph.D.  students  who  have  received  DTRA  support:  Md  Abdul  Alim,  Robert 
Curry,  Xiang  Li,  Subhankar  Mishra,  Ioannis  Pappas,  Jiaxing  Pi,  Huiling  Zhang, 
Huiyuan  Zhang 


VIII.  Impacts 


Dr.  Pardalos  was  named  the  first  Paul  and  Heidi  Brown  Preeminent  Professor  of 
Industrial  and  Systems  Engineering  at  the  University  of  Florida. 

Dr.  Smith  was  named  Professor  and  Chair  of  the  Industrial  Engineering  department 
at  Clemson  University. 

Dr.  Pardalos  won  the  following  awards  for  his  contributions  to  the  field  of 
operations  research  during  the  award  period: 

•  "Numerical  Computation:  Theory  and  Algorithms"  conference  award  for 
contributions  to  optimization 

•  Medal  in  honor  of  broad  contributions  to  science  and  engineering,  University 
of  Catania 

•  EURO  Gold  Medal  Award 

Dr.  Thai  won  the  following  awards  due  to  her  DTRA-sponsored  work. 

•  Provost’s  Excellence  Award  for  Associate  Professors  at  the  University  of 
Florida,  2010. 

•  Early  promotion  to  Full  Professor  in  2015. 

•  Her  student,  Thang  Dinh,  received  UFIC  Outstanding  International  Student 
Award. 

•  Best  conference  paper  award  for  "Online  Algorithms  for  Optimal  Resource 
Management  in  Dynamic  D2D  Communications,"  in  Proceedings  of  the  IEEE 
10th  International  Conference  on  Mobile  Ad-hoc  and  Sensor  Networks  (MSN). 

Sullivan,  K.M.  and  Smith,  J.C.,  "Exact  Algorithms  for  Solving  a  Euclidean  Maximum 
Flow  Network  Interdiction  Problem,"  Networks,  64(2),  2014  won  the  Glover- 
Klingman  Prize  for  best  paper  in  Networks. 

Romich,  A.,  Lan,  G.,  and  Smith,  J.C.,  "Optimizing  Placement  of  Stationary 
Monitors,”  HE  Transactions,  47(6),  556-576,  2015  was  a  featured  article  in  the 
Industrial  Engineering  magazine. 

DTRA-research-related  topics  were  incorporated  into  five  Ph.D. -level  classes  at  the 
University  of  Florida: 

•  Advanced  Network  Optimization 

•  Linear  Programming  Extensions 

•  Optimization  in  Adaptive  Complex  Systems  and  Social  Networks 

•  Approximation  Algorithms 


Data  Mining 


The  latter  class  was  prepared  by  Co-Pi  Pardalos,  who  taught  this  as  an  honors  level 
course  as  a  part  of  his  Dunlevie  Professorship  award,  which  he  won  during  the 
2013-14  academic  year. 


IX.  Tech  Transition 

The  PI  for  the  DTRA  grant  was  awarded  a  grant  by  the  Office  of  Naval  Research 
(ONR),  running  from  January  2013  through  the  end  of  December  2015,  The  title  of 
the  ONR  grant  is,  "Dynamic  and  Adaptive  Sensor  Operations  Under  Uncertainty,” 
and  was  awarded  to  Dr.  Smith  and  to  a  Co-PI,  Dr.  Guanghui  Lan.  The  grant  is  funded 
under  the  ONR  program  12-SN-0009,  and  is  under  the  6.2  funding  category. 

The  subject  of  our  DTRA  grant  examines  cascading  failures  in  defender-attacker- 
defender  settings.  For  instance,  a  problem  we  would  investigate  in  the  DTRA 
proposal  might  examine  a  situation  in  which  an  attacker  destroys  links  in  order  to 
maximize  the  shortest  possible  path  a  defender  could  take  in  some  network.  The 
objective  would  then  be  to  fortify  links  first,  so  that  the  attacker's  objective  is  as 
small  as  possible  (i.e.,  the  defender  minimizes  the  maximum  possible  shortest  path 
length  induced  by  the  attacker).  Of  particular  interest  are  those  problems  in  which 
the  network  is  multi-layered  and  complex. 

As  a  result  of  the  theoretical  and  methodological  advances  made  in  the  DTRA  grant, 
we  were  able  to  explore  sensor  operations  arising  in  the  defender-attacker- 
defender  setting,  for  the  ONR  proposal.  An  example  of  the  type  of  problem 
considered  in  the  ONR  program  would  be  similar  to  the  one  described  above,  but  in 
which  the  "attacker"  is  not  necessarily  an  adversary,  and  the  "defender"  is  not 
necessarily  the  protagonist.  Hence,  it  makes  more  sense  to  refer  to  these  agents  as 
"leader"  and  "follower"  to  better  fit  the  problem  context.  For  instance,  suppose  that 
the  follower  is  a  terrorist  that  seeks  to  gain  access  to  sensitive  infrastructure.  The 
leader  would  place  sensors  (or  monitors)  in  a  continuous  region  in  order  to 
minimize  the  maximum  probability  with  which  the  follower  could  reach  the 
infrastructure  undetected.  This  problem  was  inspired  by  the  defense  of  a  nuclear 
power  plant  with  access  to  public  waterways,  which  might  be  exploited  by  a 
terrorist. 

In  another  setting,  a  set  of  targets  may  need  to  be  covered  by  sensors.  The  sensors 
also  must  communicate  with  one  another  wirelessly,  suffering  some  degradation 
that  occurs  as  a  function  of  distance  between  the  sensors.  Complicating  matters  is 
the  observation  that  once  sensors  are  placed,  they  might  drift  by  some  vector. 
Drifting  could  occur  due  to  placement  error,  or  in  the  case  of  unmanned  (aerial  or 
underwater)  vehicles,  due  to  physical  currents.  To  model  the  robustness  of  our 
sensor  placement,  we  bound  placement  error  by  a  parameter,  and  conceptually 
envision  that  an  adversary  moves  each  sensor  by  a  vector  of  length  no  more  than 


this  parameter.  Hence,  the  game  proceeds  as  follows  (in  the  defender-attacker- 
defender  language):  The  defender  first  places  its  sensors,  the  attacker  perturbs  the 
sensors,  and  then  the  defender  performs  optimal  communication  among  each  pair 
of  sensors  in  their  adjusted  locations.  This  is  a  max-min-max  model,  where  the 
inner  minimization  problem  represents  the  realization  of  a  worst-case-scenario 
(which  is  defined  relative  to  each  possible  first-stage  sensor  location  decision) 
rather  than  an  actual  malicious  entity. 
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